[Open-Source-Bot]

This PR contains the following updates:

Package	Type	Update	Change
getplumber/plumber	action	minor	v0.5.15 → v0.7.23

---

Release Notes

getplumber/plumber (getplumber/plumber)

v0.7.23

Compare Source

✨ Features

• platform: the banner names the snapshot lanes carried from an earlier pass (fa02563)

✅ Tests

• platform: the carried-lanes order test feeds the lanes out of order (a521840)
• platform: the carried-lanes test puts the oldest pass on the last lane (ae251b7)

v0.7.22

Compare Source

🐛 Bug Fixes

• platform: a merge request from a fork reports its configuration unavailable instead of invalid (8a10aea)

📚 Documentation

• readme: drop the signing subsection and the scoring sentence (01466e1)

✅ Tests

• cmd: the fork reason joins the resolution through one tested function (17aa1b4)

v0.7.21

Compare Source

🐛 Bug Fixes

• platform: a merged results pipeline resolves its configuration at the source branch head (1a8ee58)

v0.7.20

Compare Source

🐛 Bug Fixes

• platform: an INVALID merge from the resolve endpoint reports the git host's own errors (3beb903)

v0.7.19

Compare Source

🐛 Bug Fixes

• github: a composite step a literal input turns off is not analyzed (eab2f54), closes #​591

📚 Documentation

• document the workflow lockfile and give it a code owner entry (665cfc5)

👷 CI/CD

• lock workflow actions and verify the lockfile on PRs (6c31fa3)
• score: publish the Plumber Score with the released action, the source build no longer pushes (c78b489)
• verify the workflow lockfile with gh-actions-lock v0.3.0 (e11334e)
• verify the workflow lockfile with gh-actions-lock v0.4.0 (247fced)

v0.7.18

Compare Source

✨ Features

• report: cliVersion, configFileSha256 and the Actions run in the JSON report (fdd8faf)
• score: a keyless Sigstore signer for the score push on GitHub Actions (f341aee)
• score: PLUMBER_SCORE_PAYLOAD_OUT writes the exact pushed bytes (c93d1ce)
• score: the score push carries the Sigstore bundle, a signing failure only warns (9d5a738)

📚 Documentation

• score: the signed score push, the provenance keys and PLUMBER_SCORE_PAYLOAD_OUT (602acc3)

v0.7.17

Compare Source

🐛 Bug Fixes

• cmd: the SARIF names a nested finding's container in its message, never in a location outside the checkout (5b53f2b)

v0.7.16

Compare Source

✨ Features

• cmd: the platform push carries the GitHub bill of materials (a2bcd78)

🐛 Bug Fixes

• cmd: no GitHub bill of materials when a workflow file does not parse (a88ce02)

v0.7.15

Compare Source

🐛 Bug Fixes

• configuration: eight GitLab-shaped controls declare GitLab only, their GitHub bench entries go (5c78ee5)

v0.7.14

Compare Source

🐛 Bug Fixes

• release: only file a remove/drop first word under Removed (f16eafd)

👷 CI/CD

• release: GitLab component notes only list what changed in the component (2ebb420), closes #​569

v0.7.13

Compare Source

🐛 Bug Fixes

• control,github: judge uses: docker:// step images like container images (c4a2e9a), closes #​571
• pbom: a docker:// step is an image, not an action include (124fae4), closes #​575 #​571 #​571
• pbom: list the images of nested docker:// steps (b7db988), closes #​575 #​571

v0.7.12

Compare Source

🐛 Bug Fixes

• github,policies: point GitHub findings at the line that fired (ad8f505), closes #​572 #​573
• policies: one line per identity, and the image line for ISSUE-101 (d872c33), closes #​572 #​572

✅ Tests

• github: a called job's resolved images keep no line (7c3effa), closes #​572
• policies: pin each line source of ISSUE-209 and ISSUE-309 (b974fd6), closes #​572

v0.7.11

Compare Source

✨ Features

• control,github: a workflow lockfile pins steps, not reusable workflows (07984e2), closes gh-actions-lock#194 #​542
• control,github: ISSUE-701 accepts a tag backed by an immutable release (9db85c9), closes #​421

🔧 Chores

• ci: bump the github-actions group with 5 updates (418f3fd)

📚 Documentation

• control: a lockfile's presence is enough, GitHub enforces its coverage (7272b17), closes #​567 #​542 #​542

✅ Tests

• cmd: cover sort and dedup of immutable release refs (a05b314)

v0.7.10

Compare Source

🔧 Chores

• deps: bump golang.org/x/term (2860509)

v0.7.9

Compare Source

✨ Features

• control: ISSUE-423, flag an invalid GitHub workflow file (71f5467)

🐛 Bug Fixes

• control,cmd: wire workflowsMustBeValid like every live GitHub control (f82148a)
• control,github: honest invalid-workflow log, drop the yaml prefix helper (fe852d9)
• control,policies: never silently drop an invalid workflow file (ccef650)
• control: every workflow invalid leaves CI controls not evaluated, not passed (3f30010)
• control: follow the policy's own control tree in platform mode (73b82e9)
• github: compare duplicate YAML keys by source text, not YAML 1.1 value (a8fbd14)
• github: duplicate YAML keys compare case-insensitively, as GitHub does (c5cc37a)
• github: separate an invalid workflow file from a collection failure (a910afe)

📚 Documentation

• control,github: scope ISSUE-423 to YAML parse failures, pin out-of-scope files (9b41d6e)

v0.7.8

Compare Source

✨ Features

• capability: in platform mode the served capabilities are the whole list (5ca84ca)

v0.7.7

Compare Source

🐛 Bug Fixes

• cmd: the platform push names the component version of the include that defines the running job (75f9ed1), closes #​562

v0.7.6

Compare Source

🐛 Bug Fixes

• github: read a local action's entrypoint within the repository (018074a)
• github: resolve only well-formed action references (b06e171)
• gitlab: bound variable and local-include expansion (13a6f97)

v0.7.5

Compare Source

✨ Features

• capability: the declarations from the context or .plumber.yaml, and the defaults command (6686e3f)
• capability: the first recognizer and the five evidence rules (31b1782)
• capability: user-declared capabilities, the built-in list and the glob matcher (024cce3)
• ir: a job carries the keys of its artifacts.reports and the include that defined it (8482d15)
• pbom: the bill carries the recognized capabilities from the push and the --pbom artifact (5541574)

v0.7.4

Compare Source

🔧 Chores

• deps: bump the go-dependencies group across 1 directory with 6 updates (d8b6b08)

v0.7.3

Compare Source

🔧 Chores

• ci: bump the github-actions group across 1 directory with 14 updates (c5b9cf0)

v0.7.2

Compare Source

✨ Features

• github: resolve composite actions and cross-repository reusable workflows into the pipeline with their provenance (1ba603c)

🐛 Bug Fixes

• control,identity: nested findings carry their chain, remediation and identity, the bill names nested includes (35459d5), closes #​533

✅ Tests

• github,cmd: goldens from the nested-actions reproduction, docs and the e2e recipe (620b4de), closes d/action.yml#L8

v0.7.1

Compare Source

✨ Features

• github: who can trigger a job, environments, inert jobs and the real token default (717c944)
• report: every claim of a path carries its state, the Radar corpus as the regression gate (b26a7ae)
• score: claim states and a three-valued evaluator for job conditions (d3cb330)
• score: the tier follows what is proven (968840b)

v0.7.0

Compare Source

⚠ BREAKING CHANGES

• controls: releaseWorkflowsMustNotRestoreUntrustedCache is renamed
  untrustedTriggersMustNotWriteCache, and publishActions, cacheActions,
  publishScriptPatterns, publishScriptExcludePatterns and allowedJobs are
  removed. The old key is ignored with a warning; plumber config migrate
  renames it. exemptWorkflows and exemptJobs accept the risk of a workflow
  or a job, listed in the output. ISSUE-705 findings re-key (RecipeVersion 7).

🐛 Bug Fixes

• controls: flag cache write granted to untrusted triggers (e8f9e5a), closes #​533

✅ Tests

• controls: pin every context a cache-mode expression can read (8fbab2b)

v0.6.5

Compare Source

✨ Features

• brand: teal banner and terminal accent for the new identity (4330818), closes #​09C3C3

📚 Documentation

• readme: teal wordmark in the plumber analyze recording (5917a18)

v0.6.4

Compare Source

✨ Features

• controls: exempt listed images on a forbidden tag (b95c432)

📚 Documentation

• add a pull request template (fff78d0)

v0.6.3

Compare Source

✨ Features

• cli: the update notice names the upgrade command of the install channel (7284a53)

✅ Tests

• cli: pin the Homebrew prefixes alone and a go install build's version (a193a10)

👷 CI/CD

• prove that brew, mise and go install serve the latest release (e25d155)
• the mise channel check resolves without the 24-hour release age (af8ce1e)

v0.6.2

Compare Source

✨ Features

• report: platform mode closes a withheld policy on the Score block too (00ae5de)
• report: the withheld score closes on the Score block too (0a909cf)

🐛 Bug Fixes

• report: findings, never issues, in every user-facing text (b809185)

📚 Documentation

• readme: add Duplicati to the adopters row (7d3a0e0), closes duplicati/duplicati#7259

✅ Tests

• report: a degraded run writes its artifacts above the withheld block (a0d6790)

v0.6.1

Compare Source

✨ Features

• conf: trust Plumber's own GitLab component by default (b400431)
• controls: components and functions must come from authorized sources (b2bb03a)
• gitlab: collect run: step functions and the registry host in the IR (59c9ddd)
• score: component and function sources in the contextual score (44c5d28)

🐛 Bug Fixes

• build: move to the Go 1.26.9 toolchain (6449f05)

v0.6.0

Compare Source

⚠ BREAKING CHANGES

• analyze: score letters, --min-score and --min-points gates and badges now read the contextual score. Run with --score-profile v3 or set PLUMBER_ANALYZE_SCORE_PROFILE=v3 to keep the previous formula.

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01Ft8dmcMLK7V9XZh7JX4vzs

✨ Features

• analyze: the contextual score is the default, on every output, with the labelled corpus and the migration report (41eff60)
• situation: job facts for attack paths, entry subjects, push trigger filters and cache inheritance (89f30e4)

v0.5.24

Compare Source

✨ Features

• config: exempt dependabot actions from the pin-by-SHA default (834d9c4)

📚 Documentation

• readme: add Outscale and Telstra to the adopters row (428a960)

✅ Tests

• control: pin the shipped pin-by-SHA trust boundary to GitHub-owned orgs (ec5c1ef), closes #​531

v0.5.23

Compare Source

✨ Features

• config: trust jfrog-fastci actions in the default allowlist (4b55d04)

v0.5.22

Compare Source

✨ Features

• config: trust CodSpeedHQ actions in the default allowlist (27f0d74)

v0.5.21

Compare Source

✨ Features

• #​362: run the job in a dedicated environment (69fc105), closes #​362

📚 Documentation

• #​362: scope GITLAB_TOKEN to the plumber environment (85caadb), closes #​362
• readme: add Stellarium to the adopters row (338ab07)

v0.5.20

Compare Source

✨ Features

• control: a role per issue code and one severity source (d1a6b4a)

v0.5.19

Compare Source

✨ Features

• control: evaluate the situation facts and attach them to the analysis (399b67d)
• gitlab: jobs carry only and except (ce1bdf5)
• situation: per-job situation facts and their engine entry point (3f286fa)

v0.5.18

Compare Source

✨ Features

• github: collect the repository visibility into the pipeline (0f8e228)
• github: jobs carry runs-on, needs, caches and artifacts (7d98eff)
• gitlab: copy the project visibility onto the pipeline (6f3c660)
• gitlab: jobs carry needs, caches, artifacts and environment (b40dcc5)
• ir: visibility, runs-on, needs, caches and artifacts on the pipeline model (9bd2d5a)

📚 Documentation

• readme: use the official Resty logo in the adopters row (40125a7)

v0.5.17

Compare Source

✨ Features

• analyze: accept the repository to scan as a positional target (14f3908)

📚 Documentation

• show the positional target in the remote-scan examples (c991a47)

v0.5.16

Compare Source

🐛 Bug Fixes

• docker: build the image binary for the target platform (8363ff5)

📚 Documentation

• contributing: describe the release order and its operation (0e07fa2)
• readme: focused CLI README with a real run GIF and a new banner (4a1e7a3), closes getplumber/getplumber.io#438

👷 CI/CD

• release: add the scripts that pin the image digest at the tag (9fca2fe)
• release: build the image before the tag, pin its digest in it (858a132)
• release: pin v0.5.15 refs [skip ci] (20d607d)

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At 10:00 PM through 11:59 PM and 12:00 AM through 06:59 AM (* 22-23,0-6 * * *)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.