v0.74.0

• sigstore: make retry on manifest unknown optional by @crazy-max in #934

Full Changelog: v0.73.0...v0.74.0

v0.73.0

• sigstore: add function to verify image attestations by @crazy-max in #932
• sigstore: test signAttestationManifests by @crazy-max in #933
• build(deps): bump @actions/artifact from 5.0.1 to 5.0.2 in #926
• build(deps): bump @actions/cache from 5.0.1 to 5.0.2 in #925
• build(deps): bump @actions/core from 2.0.1 to 2.0.2 in #922
• build(deps): bump @actions/github from 6.0.1 to 7.0.0 in #923
• build(deps): bump @actions/http-client from 3.0.0 to 3.0.1 in #921
• build(deps): bump @actions/tool-cache from 2.0.2 to 3.0.0 in #924

Full Changelog: v0.72.0...v0.73.0

v0.72.0

• git: handle detached head error by @neilime in #915
• update @sigstore/sign to 4.1.0 by @crazy-max in #917 #918
• build(deps): bump @sigstore/tuf from 4.0.0 to 4.0.1 in #914
• build(deps): bump @sigstore/verify from 3.0.0 to 3.1.0 in #913

Full Changelog: v0.71.0...v0.72.0

v0.71.0

• cosign(install): verify binary signature with keyless verification bundle by @crazy-max in #904
• docker(install): unpin QEMU by @crazy-max in #896
• build(deps): bump @actions/artifact from 4.0.0 to 5.0.1 in #893
• build(deps): bump @actions/cache from 4.1.0 to 5.0.1 in #892
• build(deps): bump @actions/core from 1.11.1 to 2.0.1 in #889
• build(deps): bump @actions/exec from 1.1.1 to 2.0.0 in #885
• update dev dependencies by @crazy-max in #902 #903

Full Changelog: v0.69.0...v0.71.0

v0.70.0

Important

This release was not published to npm.
Our previous npm access token was rejected following npm's classic tokens revoked, so @docker/actions-toolkit@0.70.0 is currently missing from the npm registry. Please use the latest published version on npm (or install directly from Git tags) until a subsequent release is published via Trusted Publishing.

• cosign(install): verify binary signature with keyless verification bundle by @crazy-max in #904
• docker(install): unpin QEMU by @crazy-max in #896
• build(deps): bump @actions/artifact from 4.0.0 to 5.0.1 in #893
• build(deps): bump @actions/cache from 4.1.0 to 5.0.1 in #892
• build(deps): bump @actions/core from 1.11.1 to 2.0.1 in #889
• build(deps): bump @actions/exec from 1.1.1 to 2.0.0 in #885
• update dev dependencies by @crazy-max in #902 #903

Full Changelog: v0.69.0...v0.70.0

v0.69.0

• docker(install): pin QEMU to 10.1.1 by @crazy-max in #880

Full Changelog: v0.68.0...v0.69.0

v0.68.0

• buildx(bake): funcs to check attest set in bake definition by @crazy-max in #873
• git: support getting ref in various detached HEAD contexts by @neilime in #856
• releases: download releases JSON without token first by @crazy-max in #875
• sigstore: remove verbose flag from persisted cosign args by @crazy-max in #854
• build(deps): bump js-yaml from 4.1.0 to 4.1.1 in #860
• build(deps): bump @actions/http-client from 2.2.3 to 3.0.0 in #831
• build(deps): bump @actions/io from 1.1.3 to 2.0.0 in #832

Full Changelog: v0.67.0...v0.68.0

v0.67.0

• cache: gracefully handle cache restore failures with warning by @crazy-max in #842
• sigstore: remove @actions/attest dependency by @crazy-max in #843
• build(deps): bump @sigstore/bundle from 3.1.0 to 4.0.0 in #840
• build(deps): bump @sigstore/sign from 3.1.0 to 4.0.1 in #844

Full Changelog: v0.66.0...v0.67.0

v0.66.0

• sigstore: multi image names support for signing by @crazy-max in #841
• build(deps): bump @octokit/request-error from 5.0.0 to 5.1.1 in #836
• build(deps): bump @octokit/request from 8.1.1 to 8.4.1 in #836

Full Changelog: v0.65.0...v0.66.0

v0.65.0

• use github token to fetch releases JSON from CDN if available by @crazy-max in #819
• sigstore class to sign and verify BuildKit attestation manifests and provenance blobs by @crazy-max in #820 #830
• cosign install and command support by @crazy-max in #826 #827 #828 #825
• buildx(imagetools): return attestations digests by @crazy-max in #823
• docker(install): update lima images by @crazy-max in #821
• docker(install): don't use local system resolver with lima and increase timeouts by @crazy-max in #837 #839
• build(deps): bump @actions/artifact from 2.3.2 to 4.0.0 in #818

Full Changelog: v0.64.0...v0.65.0