v0.12.7

0.12.7 (2026-07-12)

Bug Fixes

• leak-scan: replace --files-at-commit with gitleaks git --log-opts for pr-diff mode (#75) (4be901c)

v0.12.6

0.12.6 (2026-07-12)

Bug Fixes

• deploy-artifact: anchor kind=Secret grep to prevent SecretStore over-match (#73) (8e57f62)

v0.12.5

0.12.5 (2026-07-10)

Bug Fixes

• leak-scan: replace --all with --log-opts=--all for gitleaks v8.x (#67) (d993ef7)

v0.12.4

0.12.4 (2026-07-10)

Bug Fixes

• leak-scan: install gitleaks+trufflehog with SHA pins; fail-closed all-refs mode (#63) (1ddf81e)

v0.12.3

0.12.3 (2026-07-10)

Bug Fixes

• deploy-preview: fail loud on render failures and anchor the raw-secret match (#62) (36710bd)

v0.12.2

0.12.2 (2026-07-10)

Bug Fixes

• deploy-preview: scorecard gate misjudges not_applicable, no_raw_secrets, and npm_signatures_verified (#60) (77c8d5c)

v0.12.1

0.12.1 (2026-07-10)

Bug Fixes

• deploy-artifact: handle npm audit no-deps skip for GHPR scoped packages (5039ff0)

v0.12.0

0.12.0 (2026-07-09)

Features

• leak-scan: add exclude-paths input for pr-diff mode (c8c23b5)

v0.11.11

0.11.11 (2026-07-09)

Bug Fixes

• remove tag from attest subject-name (#53) (597a48f)

v0.11.10

0.11.10 (2026-07-09)

Bug Fixes

• add subject-name to attest-build-provenance step (#51) (07eff62)