v0.15.4

What's Changed

• Refactor global values to be defaults by @nmittler in #1318

• Bump actions/checkout from 4.1.5 to 4.1.6 by @dependabot in #1316

• Bump github.com/docker/docker from 26.1.2+incompatible to 26.1.3+incompatible by @dependabot in #1315

• Bump github/codeql-action from 2.13.4 to 3.25.5 by @dependabot in #1319

• Bump github/codeql-action from 3.25.5 to 3.25.6 by @dependabot in #1321

Full Changelog: v0.15.3...v0.15.4

v0.15.3

🚨 We are investigating an issue with this release 🚨
See #1317 for more details.

What's Changed

• Bump golang/govulncheck-action from 1.0.1 to 1.0.2 by @dependabot in #1244
• Fix fly.io deployment docs by @imjasonh in #1247
• Bump golang.org/x/tools from 0.18.0 to 0.19.0 by @dependabot in #1249
• Update setup-ko action link in install.md by @koki-develop in #1256
• Fix kind image names with --bare by @aidy in #1027
• fix: update github.com/awslabs/amazon-ecr-credential-helper to latest version by @nesty92 in #1267
• drop go1.20 and start testing with go1.22 and ci updates by @cpanato in #1251
• Bump slsa-framework/slsa-github-generator from 1.9.0 to 1.10.0 by @dependabot in #1265
• Bump reviewdog/action-misspell from 1.15.0 to 1.16.0 by @dependabot in #1252
• Bump github.com/google/go-containerregistry from 0.19.0 to 0.19.1 by @dependabot in #1258
• Bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in #1255
• Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 by @dependabot in #1257
• Bump gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3 by @dependabot in #1253
• Bump actions/setup-python from 5.0.0 to 5.1.0 by @dependabot in #1269
• Bump k8s.io/apimachinery from 0.29.2 to 0.29.3 by @dependabot in #1259
• Bump github.com/docker/docker from 25.0.3+incompatible to 26.0.0+incompatible by @dependabot in #1263
• Bump reviewdog/action-misspell from 1.16.0 to 1.17.0 by @dependabot in #1270
• Add support for setting capabilities on the app binary by @mejedi in #1271
• Bump golang.org/x/sync from 0.6.0 to 0.7.0 by @dependabot in #1273
• Bump golang.org/x/tools from 0.19.0 to 0.20.0 by @dependabot in #1272
• Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 by @dependabot in #1275
• Bump github.com/docker/docker from 26.0.0+incompatible to 26.0.1+incompatible by @dependabot in #1277
• chore: fix function names in comment by @camcui in #1278
• Bump k8s.io/apimachinery from 0.29.3 to 0.29.4 by @dependabot in #1279
• Fix AWS Lambda advanced docs by @mattn in #1281
• Bump actions/upload-artifact from 4.3.1 to 4.3.2 by @dependabot in #1284
• Bump github.com/docker/docker from 26.0.1+incompatible to 26.0.2+incompatible by @dependabot in #1283
• Bump actions/checkout from 4.1.2 to 4.1.3 by @dependabot in #1285
• Bump github.com/docker/docker from 26.0.2+incompatible to 26.1.0+incompatible by @dependabot in #1286
• Bump actions/upload-artifact from 4.3.2 to 4.3.3 by @dependabot in #1288
• Bump slsa-framework/slsa-github-generator from 1.10.0 to 2.0.0 by @dependabot in #1287
• Bump actions/checkout from 4.1.3 to 4.1.4 by @dependabot in #1290
• Bump golangci/golangci-lint-action from 4.0.0 to 5.0.0 by @dependabot in #1289
• Bump golangci/golangci-lint-action from 5.0.0 to 5.1.0 by @dependabot in #1291
• Bump github.com/docker/docker from 26.1.0+incompatible to 26.1.1+incompatible by @dependabot in #1292
• Bump actions/setup-go from 5.0.0 to 5.0.1 by @dependabot in #1293
• Bump golangci/golangci-lint-action from 5.1.0 to 5.3.0 by @dependabot in #1294
• Update index.md by @xcloudscript in #1295
• Bump golang.org/x/tools from 0.20.0 to 0.21.0 by @dependabot in #1299
• Bump actions/checkout from 4.1.4 to 4.1.5 by @dependabot in #1298
• Bump golangci/golangci-lint-action from 5.3.0 to 6.0.0 by @dependabot in #1297
• update golangci-lint by @cpanato in #1296
• Bump github.com/docker/docker from 26.1.1+incompatible to 26.1.2+incompatible by @dependabot in #1303
• Bump goreleaser/goreleaser-action from 5.0.0 to 5.1.0 by @dependabot in #1309
• Bump golangci/golangci-lint-action from 6.0.0 to 6.0.1 by @dependabot in #1300
• Bump sigs.k8s.io/kind from 0.22.0 to 0.23.0 by @dependabot in #1311
• feat: Add global env by @nmittler in #1310
• feat: Add template params for git by @nmittler in #1307
• Remove vendor directory by @nmittler in #1312
• feat: add template params for platform info by @nmittler in #1302
• Add global flags and ldflags by @nmittler in #1314

New Contributors

• @koki-develop made their first contribution in #1256
• @nesty92 made their first contribution in #1267
• @mejedi made their first contribution in #1271
• @camcui made their first contribution in #1278
• @mattn made their first contribution in #1281
• @xcloudscript made their first contribution in #1295
• @nmittler made their first contribution in #1310

Full Changelog: v0.15.2...v0.15.3

v0.15.2

What's Changed

• Fix kind image loading for MacOS by @aidy in #1057
• Bump golang.org/x/tools from 0.15.0 to 0.16.0 by @dependabot in #1185
• (feat) Adding styling to code blocks by @userbradley in #1187
• Bump github.com/google/go-containerregistry from 0.16.1 to 0.17.0 by @dependabot in #1188
• Correct cluster name in error message when no nodes are found by @SaschaSchwarze0 in #1189
• Bump actions/setup-python from 4.7.1 to 4.8.0 by @dependabot in #1192
• Bump github.com/sigstore/cosign/v2 from 2.2.1 to 2.2.2 by @dependabot in #1191
• Bump github.com/spf13/viper from 1.17.0 to 1.18.0 by @dependabot in #1196
• Bump actions/setup-python from 4.8.0 to 5.0.0 by @dependabot in #1195
• Bump actions/setup-go from 4.1.0 to 5.0.0 by @dependabot in #1194
• Bump actions/stale from 8.0.0 to 9.0.0 by @dependabot in #1197
• Bump reviewdog/action-misspell from 1.14.0 to 1.14.1 by @dependabot in #1200
• Bump github.com/spf13/viper from 1.18.0 to 1.18.1 by @dependabot in #1199
• chore: add capsule as lover by @oliverbaehler in #1193
• Bump sigstore/cosign-installer from 3.2.0 to 3.3.0 by @dependabot in #1201
• Bump golang.org/x/tools from 0.16.0 to 0.16.1 by @dependabot in #1202
• Bump k8s.io/apimachinery from 0.28.4 to 0.29.0 by @dependabot in #1203
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 by @dependabot in #1204
• Bump github.com/spf13/viper from 1.18.1 to 1.18.2 by @dependabot in #1206
• Bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @dependabot in #1205
• Bump reviewdog/action-misspell from 1.14.1 to 1.15.0 by @dependabot in #1207
• Fix the KO_CONFIG_PATH default value in the documentation by @amirh in #1208
• Bump golang.org/x/sync from 0.5.0 to 0.6.0 by @dependabot in #1209
• Bump golang.org/x/tools from 0.16.1 to 0.17.0 by @dependabot in #1211
• Bump actions/upload-artifact from 4.0.0 to 4.1.0 by @dependabot in #1212
• Bump k8s.io/apimachinery from 0.29.0 to 0.29.1 by @dependabot in #1213
• Bump github.com/google/go-containerregistry from 0.17.0 to 0.18.0 by @dependabot in #1214
• Bump actions/upload-artifact from 4.1.0 to 4.2.0 by @dependabot in #1215
• Bump actions/upload-artifact from 4.2.0 to 4.3.0 by @dependabot in #1219
• Bump github.com/google/go-containerregistry from 0.18.0 to 0.19.0 by @dependabot in #1222
• Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 by @dependabot in #1224
• Bump github.com/sigstore/cosign/v2 from 2.2.2 to 2.2.3 by @dependabot in #1223
• Bump github.com/docker/docker from 24.0.7+incompatible to 25.0.2+incompatible by @dependabot in #1225
• Bump sigs.k8s.io/kind from 0.20.0 to 0.21.0 by @dependabot in #1226
• Bump github.com/opencontainers/image-spec from 1.1.0-rc5 to 1.1.0-rc6 by @dependabot in #1230
• Bump actions/upload-artifact from 4.3.0 to 4.3.1 by @dependabot in #1229
• Bump github.com/docker/docker from 25.0.2+incompatible to 25.0.3+incompatible by @dependabot in #1234
• Bump aws-actions/configure-aws-credentials from 4.0.1 to 4.0.2 by @dependabot in #1233
• Bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 by @dependabot in #1237
• Bump golang.org/x/tools from 0.17.0 to 0.18.0 by @dependabot in #1238
• Bump sigs.k8s.io/kind from 0.21.0 to 0.22.0 by @dependabot in #1239
• Bump k8s.io/apimachinery from 0.29.1 to 0.29.2 by @dependabot in #1240
• Bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 by @dependabot in #1242

New Contributors

• @userbradley made their first contribution in #1187
• @SaschaSchwarze0 made their first contribution in #1189
• @oliverbaehler made their first contribution in #1193
• @amirh made their first contribution in #1208

Full Changelog: v0.15.1...v0.15.2

v0.15.1

What's Changed

• Don't AppendDescriptor until we've written config by @jonjohnsonjr in #1175
• Add more locking around on-disk image cache by @jonjohnsonjr in #1176
• Fix "AM" Time Typo by @StephenGrider in #1179
• docs: add MacPorts install info by @herbygillot in #1180

New Contributors

• @StephenGrider made their first contribution in #1179
• @herbygillot made their first contribution in #1180

Full Changelog: v0.15.0...v0.15.1

v0.15.0

What's Changed

• implement dumb cache for images by @jonjohnsonjr in #1102
• fixed typo in configuration.md by @samlaf in #1105
• pkg/commands: fix dropped errors by @alrs in #1109
• ci: add govulncheck by @imjasonh in #1110
• chore: remove refs to deprecated io/ioutil by @testwill in #1092
• Update install docs to install ko using Scoop by @pgrunm in #1118
• include go build output in build error by @imjasonh in #1127
• Use go1.21, clean up ci and drop go1.19 by @cpanato in #1137
• Update e2e.yaml by @imjasonh in #1141
• handle newfound lint errors by @imjasonh in #1142
• fix test broken by lint fix by @imjasonh in #1143
• Bump actions/checkout from 3.6.0 to 4.0.0 by @dependabot in #1136
• fix env var for go env by @cpanato in #1140
• docs: add docs for TF and Lambda by @imjasonh in #1139
• docs: add Lambda and TF pages to sidebar by @imjasonh in #1144
• include example using go packages by @imjasonh in #1145
• fix the release workflow and install instructions by @developer-guy in #1150
• update missing places that was using go1.20 by @cpanato in #1163

New Contributors

• @samlaf made their first contribution in #1105
• @alrs made their first contribution in #1109
• @testwill made their first contribution in #1092
• @pgrunm made their first contribution in #1118

Full Changelog: v0.14.1...v0.15.0

v0.14.1

What's Changed

• fix: Use attestation-name output by @ianlewis in #980
• Upgrade to go120 by @cpanato in #984
• fix release workflow by @imjasonh in #977
• fix deprecated attestation name by @developer-guy in #983
• refactor release job by @cpanato in #986
• use git hash instead of git tag by @cpanato in #988
• Correct a typo in resolver.go by @felixonmars in #989
• feat: add riscv64 to goreleaser goarch by @ernado in #990
• try to fix codeql workflow by @imjasonh in #994
• Push images faster by @jonjohnsonjr in #1005
• Don't publish tags twice by @jonjohnsonjr in #1010
• Add context to many gobuild errors by @jonjohnsonjr in #1016
• Fix --local with KO_DOCKER_REPO by @jonjohnsonjr in #1017
• Fix: Incorporate platform architecture by @mattmoor in #1029
• Update community.md by @imjasonh in #1035
• mention ko tekton task by @imjasonh in #1039
• Update community.md by @imjasonh in #1037
• Fix kind image loading for MacOS by @aidy in #1026
• Revert "Fix kind image loading for MacOS" by @imjasonh in #1054
• update boilerplate file to be KO Build Authors by @cpanato in #1056
• Pin setup-ko to previous release by @jonjohnsonjr in #1082

New Contributors

• @felixonmars made their first contribution in #989
• @ernado made their first contribution in #990
• @aidy made their first contribution in #1026
• @luhring made their first contribution in #1073

Full Changelog: v0.13.0...v0.14.1

v0.14.0

Merge pull request #1079 from ko-build/dependabot/github_actions/slsa…

…-framework/slsa-github-generator-1.7.0

Bump slsa-framework/slsa-github-generator from 1.6.0 to 1.7.0

v0.13.0

What's Changed

• SPDX: Fix package manager label by @puerco in #801
• SPDX 2.3 support by @puerco in #803
• ci: build and test using 1.18 and 1.19 (drop 1.17) by @imjasonh in #812
• removes repo move message by @mchmarny in #814
• feat: write sbom result to disk by @developer-guy in #822
• feat: adding support for using multiple keychain for sending sbom results to a different repository by @developer-guy in #821
• Move docs to ko.build by @imjasonh in #749
• Update setup-ko version by @ianlewis in #836
• Add -- usage in readme by @jwcesign in #840
• add CONTRIBUTING, code of conduct, roadmap by @imjasonh in #837
• attempt to fix GH Pages publishing by @imjasonh in #843
• doc: fix link to Installation page in Getting Started by @antoineco in #846
• .ko.yaml: bump golang 1.18 -> 1.19 by @srenatus in #848
• truncate -image-refs file by @imjasonh in #855
• update docs: fix broken links, align with README by @imjasonh in #854
• Handle KO_DOCKER_REPO=ko.local/repo and --bare correctly by @imjasonh in #820
• another docs update by @imjasonh in #856
• ko.build: support some common shortlinks by @imjasonh in #872
• install: fail with 404 instead of gzip error when url was wrong by @grosser in #879
• feat: deduplicate tags by @bluebrown in #884
• install mkdocs-redirect when publishing site by @imjasonh in #873
• nit: replace one-item slice with const by @imjasonh in #885
• Temp fix for SLSA generators by @laurentsimon in #886
• Fix verifier by @laurentsimon in #891
• Fix link in static-assets.md by @yuryu in #893
• add KO_DEFAULTBASEIMAGE usage to docs by @developer-guy in #895
• Publish an tagged image on release by @vdemeester in #868
• Add option to configure default platforms by @ReToCode in #897
• Fix broken SLSA link by @imjasonh in #899
• add MAINTAINERS.md by @imjasonh in #905
• fix: possible race condition when applying templates to flags/ldflags by @caarlos0 in #913
• update docs to reflect actual default base image by @imjasonh in #903
• remove repeated error message on failure by @imjasonh in #921
• website: update CNCF announcement by @imjasonh in #920
• fix KO_CONFIG_PATH pointing to a file by @imjasonh in #923
• upgrade to cosign v2.0.0-rc.0 by @imjasonh in #933
• Feature: Add ECR presubmit testing. by @mattmoor in #934
• remove 'ko deps' by @imjasonh in #937
• feat: Add KO_GO_PATH env var by @embano1 in #930
• add ko.build/slack short link by @imjasonh in #945
• update link to ko goreleaser docs by @imjasonh in #936
• add ko community meeting details by @developer-guy in #938
• fix cosign by adding --yes by @imjasonh in #973
• fix: handle docker's unknown/unknown platform in index manifests by @imjasonh in #975
• fix file extension for cyclonedx by @developer-guy in #974

New Contributors

• @ianlewis made their first contribution in #836
• @jwcesign made their first contribution in #840
• @srenatus made their first contribution in #848
• @grosser made their first contribution in #879
• @bluebrown made their first contribution in #884
• @yuryu made their first contribution in #893
• @vdemeester made their first contribution in #868
• @ReToCode made their first contribution in #897
• @embano1 made their first contribution in #930

Full Changelog: v0.12.0...v0.13.0

v0.12.0

What's Changed

• Bump github.com/docker/docker from 20.10.13+incompatible to 20.10.14+incompatible by @dependabot in #673
• Add purls to SPDX sbom by @puerco in #677
• Bump actions/setup-go from 2 to 3 by @dependabot in #680
• Bump sigstore/cosign-installer from 2.1.0 to 2.2.0 by @dependabot in #683
• Bump codecov/codecov-action from 2.1.0 to 3.0.0 by @dependabot in #682
• Bump actions/upload-artifact from 2 to 3 by @dependabot in #681
• Bump ecr-login dep and update WithLogger callsite by @imjasonh in #658
• check and use the latest go available for the defined version by @cpanato in #690
• Bump k8s.io/apimachinery from 0.23.5 to 0.23.6 by @dependabot in #691
• Bump codecov/codecov-action from 3.0.0 to 3.1.0 by @dependabot in #692
• Bump github.com/spf13/viper from 1.10.1 to 1.11.0 by @dependabot in #686
• Bump github.com/containerd/stargz-snapshotter/estargz from 0.11.3 to 0.11.4 by @dependabot in #685
• Bump github.com/google/go-cmp from 0.5.7 to 0.5.8 by @dependabot in #695
• Bump sigstore/cosign-installer from 2.2.1 to 2.3.0 by @dependabot in #697
• Bump github/codeql-action from 1 to 2 by @dependabot in #696
• Fix texts regarding SBOM by @otms61 in #698
• Bump k8s.io/apimachinery from 0.23.6 to 0.24.0 by @dependabot in #701
• Bump github.com/docker/docker from 20.10.14+incompatible to 20.10.15+incompatible by @dependabot in #700
• Bump sigs.k8s.io/kind from 0.12.0 to 0.13.0 by @dependabot in #703
• Bump github.com/docker/docker from 20.10.15+incompatible to 20.10.16+incompatible by @dependabot in #704
• Bump sigs.k8s.io/kind from 0.13.0 to 0.14.0 by @dependabot in #708
• Bump goreleaser/goreleaser-action from 2.9.1 to 3.0.0 by @dependabot in #709
• Use sync.Map to cache base image lookups by @imjasonh in #712
• Bump k8s.io/apimachinery from 0.24.0 to 0.24.1 by @dependabot in #714
• Bump github.com/spf13/viper from 1.11.0 to 1.12.0 by @dependabot in #715
• add warning when using both --local and KO_DOCKER_REPO to ko.local by @cpanato in #629
• Bump gopkg.in/yaml.v3 from 3.0.0 to 3.0.1 by @dependabot in #719
• Bump deps to silence security alerts by @imjasonh in #667
• check if have all and other platforms set in the --platform flag by @cpanato in #630
• Bump github.com/sigstore/cosign from 1.8.0 to 1.9.0 by @dependabot in #721
• docs(readme): add sbom section by @developer-guy in #710
• allow refs-file to be read by other users by @seankhliao in #723
• Bump golang.org/x/tools from 0.1.10 to 0.1.11 by @dependabot in #724
• Bump github.com/docker/docker from 20.10.16+incompatible to 20.10.17+incompatible by @dependabot in #725
• Bump sigstore/cosign-installer from 2.3.0 to 2.4.0 by @dependabot in #726
• build: Imply current import path by @imjasonh in #717
• Allow KO_CONFIG_PATH to be a file by @benmoss in #731
• Bump k8s.io/apimachinery from 0.24.1 to 0.24.2 by @dependabot in #732
• Bump github.com/google/go-containerregistry from 0.9.0 to 0.10.0 by @dependabot in #735
• Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 by @dependabot in #734
• Update base image to ghcr.io/distroless/static:latest by @imjasonh in #737
• Convert our SPDX SBOMs to spdx+json. by @mattmoor in #740
• Fix off-by-one error by @mattmoor in #742
• Add externalDocumentRefs to SPDX doc type by @puerco in #741
• Bump sigstore/cosign-installer from 2.4.0 to 2.4.1 by @dependabot in #746
• Unconditionally set the base image annotation. by @mattmoor in #745
• Start emitting multi-arch SBOMs for SPDX with ko by @mattmoor in #743
• Add base image information to SPDX SBOMs by @mattmoor in #744
• don't fail if LDFLAGS env isn't set by @imjasonh in #758
• Several SPDX SBOM adjustments. by @mattmoor in #760
• Decorate per-architecture images with base image annotations. by @mattmoor in #759
• Have --image-refs list all images for multi-arch builds. by @mattmoor in #761
• remove deprecated k8s flags support by @imjasonh in #750
• Reject the -toolexec flag by @imjasonh in #752
• Add installation instructions for Alpine by @imjasonh in #754
• ko run: remove --generator flag by @imjasonh in #751
• exercise symlink chasing without .git by @imjasonh in #763
• Chore: bumped base image to go 1.18 by @ellistarn in #764
• Add a delimiter before digest in the SPDX namespace by @mattmoor in #765
• Bump k8s.io/apimachinery from 0.24.2 to 0.24.3 by @dependabot in #767
• Bump github.com/containerd/stargz-snapshotter/estargz from 0.11.4 to 0.12.0 by @dependabot in #768
• Use chainguard-dev/actions/setup-registry by @imjasonh in #772
• bump go-containerregistry dependency by @imjasonh in #773
• Remove redundant return path by @jonjohnsonjr in #774
• fix GitHub Actions workflows by @imjasonh in #777
• Deprecate ko deps by @imjasonh in #770
• Set layer media types consistently by @imjasonh in #776
• Add kind e2e test for ko run by @imjasonh in #779
• Add tests that ko can push to quay.io and Dockerhub by @imjasonh in #778
• Fix e2e push tests, these registries need --bare by @imjasonh in #780
• Bump github.com/sigstore/cosign from 1.9.0 to 1.10.0 by @dependabot in #781
• Bump golang.org/x/tools from 0.1.11 to 0.1.12 by @dependabot in #783
• Bump sigstore/cosign-installer from 2.4.1 to 2.5.0 by @dependabot in #784
• Bump github.com/sigstore/cosign from 1.10.0 to 1.10.1 by @dependabot in #786
• expose commands.ResolveFilesToWriter() method by @joshrwolf in #787
• feat: generate SLSA provenance for release binaries by @laurentsimon in #730
• adds org move message by @mchmarny in #789
• update default base image to distroless.dev/static by @imjasonh in #790
• Error if image platform does not match desired by @benmoss in #785
• Bump k8s.io/apimachinery from 0.24.3 to 0.24.4 by @dependabot in #792
• Bump github.com/sigstore/cosign from 1.10.1 to 1.11.0 by @dependabot in #793
• Bump sigstore/cosign-installer from 2.5.0 to 2.5.1 by @dependabot in #794
• Extend ko.local and kind.local detection to include sub-repos by @imjasonh in #796
• Support --tag and --tag-only with nop publisher by @imjasonh in #797

New Contributors

• @puerco made their first contribution in #677
• @otms61 made their first contribution in #698
• @seankhliao made their first contribution in #723
• @ellistarn made their first contribution in #764
• @joshrwolf made their first contribution in #787
• @laurentsimon made their first contribution in #730
• @mchmarny made their first contribution in #789

Full Changelog: v0.11.2...v0.12.0

v0.11.2

Changelog

• 9459e51: Bump github.com/containerd/stargz-snapshotter/estargz (#664) (@dependabot[bot])
• 61b3ccd: Bump golang.org/x/tools from 0.1.9 to 0.1.10 (#663) (@dependabot[bot])
• 327a88f: Bump k8s.io/apimachinery from 0.23.4 to 0.23.5 (#662) (@dependabot[bot])
• cefd28f: go1.18: Preserve trailing tabs while massaging go version -m output (#668) (@tstromberg)