v0.44.3

0.44.3 (2026-07-20)

Updates

• ci: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 (#259) (953c51d)
• ci: bump docker/metadata-action from 6.1.0 to 6.2.0 (#258) (475cc91)
• ci: bump docker/login-action from 4.2.0 to 4.4.0 (#257) (2bb8baf)
• ci: bump docker/setup-buildx-action from 4.1.0 to 4.2.0 (#256) (1066b3d)
• ci: bump astral-sh/ruff-action from 4.0.0 to 4.1.0 (#255) (4da3205)
• ci: bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#245) (c49d259)
• ci: bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#250) (24cc78c)
• ci: bump docker/build-push-action from 7.2.0 to 7.3.0 (#249) (cad831f)
• ci: bump docker/setup-docker-action from 5.2.0 to 5.3.0 (#248) (d475f7b)
• ci: bump ansible/ansible-lint from 26.4.0 to 26.6.0 (#247) (cf7c2ca)
• ci: bump actions/setup-python from 6.2.0 to 6.3.0 (#246) (ef1fed8)
• ci: bump actions/checkout from 6.0.3 to 7.0.0 (#244) (998394a)

Documentation

• well, copilot, i guess (#253) (db881d1)
• remove duplicated section (#252) (7f2b00c)
• document ENISA section 4.1.6 (#251) (8b28f6b)

CI

• run zizmor smoke tests with pedantic persona (#254) (24741f2)

v0.44.2

0.44.2 (2026-06-15)

Bug Fixes

• release-container: replace cosign dockerfile verify with cosign verify (#243) (5dafb46)

Chores

• ci: bump github/codeql-action from 4.36.0 to 4.36.2 (#242) (625e094)
• ci: bump actions/checkout from 6.0.2 to 6.0.3 (#241) (ec74b37)
• ci: bump docker/setup-qemu-action from 4.0.0 to 4.1.0 (#240) (774dd48)
• ci: bump docker/setup-docker-action from 5.1.0 to 5.2.0 (#239) (2ec8321)
• ci: bump docker/setup-buildx-action from 4.0.0 to 4.1.0 (#237) (e9bd392)
• ci: bump github/codeql-action from 4.35.5 to 4.36.0 (#236) (b56d452)
• ci: bump docker/login-action from 4.1.0 to 4.2.0 (#235) (9295e55)
• ci: bump docker/metadata-action from 6.0.0 to 6.1.0 (#234) (9b5bf22)
• ci: bump docker/build-push-action from 7.1.0 to 7.2.0 (#233) (9c27475)
• ci: bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#232) (99178ba)
• ci: bump github/codeql-action from 4.35.4 to 4.35.5 (#231) (1f35a14)
• ci: bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#228) (b86cfb4)
• ci: bump github/codeql-action from 4.35.3 to 4.35.4 (#229) (b8b5032)

v0.44.1

0.44.1 (2026-05-11)

Bug Fixes

• release-python-poetry: Add deploy-mkdocs flag to disable mkdocs gh-deploy (#227) (b37e513)

v0.44.0

0.44.0 (2026-05-11)

Feature

• add release-zensical workflow, deprecate release-mkdocs (#224) (7a3366e)

Chores

• ci: bump github/codeql-action from 4.35.2 to 4.35.3 (#225) (8b51252)
• ci: bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 (#222) (133b6a0)
• ci: bump docker/setup-docker-action from 5.0.0 to 5.1.0 (#223) (3beac9f)
• ci: bump github/codeql-action from 4.35.1 to 4.35.2 (#221) (90d0c9a)

v0.43.4

0.43.4 (2026-04-20)

Bug Fixes

• test-ansible-collection: fix ruff call (#220) (f49d301)

v0.43.3

0.43.3 (2026-04-20)

Bug Fixes

• test-ansible-collection: replace flake8 and black with ruff (#219) (2e19435)

Chores

• ci: bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 (#218) (f441bec)

v0.43.2

0.43.2 (2026-04-19)

Bug Fixes

• persist-credentials for mkdocs gh-deploy in release-python-poetry and remove concurrency for release-mkdocs (#217) (5459c6e)

Chores

• ci: bump docker/build-push-action from 7.0.0 to 7.1.0 (#216) (d492369)

v0.43.1

0.43.1 (2026-04-09)

Bug Fixes

• ci: bump sigstore/cosign-installer from 3.10.1 to 4.1.1 (#209) (3f1ee42)
• ci: bump docker/login-action from 4.0.0 to 4.1.0 (#214) (65b1a87)

Chores

• ci: bump https://github.com/pre-commit/pre-commit-hooks from v5.0.0 to 6.0.0 in the pre-commit-hooks group (#215) (a336388)

v0.43.0

0.43.0 (2026-04-09)

Feature

• ci: bump ansible/ansible-lint from 26.3.0 to 26.4.0 (#211) (9421e9c)
• ci: bump github/codeql-action from 4.34.1 to 4.35.1 (#210) (bcb647a)

Chores

• smoke test every reusable workflow on every PR (#213) (e3eb662)
• remove slop (#208) (213755c)

v0.42.0

0.42.0 (2026-03-29)

This releases adds name: labels for all jobs and steps, users might need to update required actions.

Feature

• add test-github-actions reusable workflow (zizmor SAST) (#204) (4799961). Implementing this action is strongly encourage and can be done by adding the following to an existing pull_request: workflow like test.yaml (or release.yaml if applicable).

  github-actions:
    permissions:
      contents: read
      security-events: write # so zizmor can publish results to the Security tab
    uses: radiorabe/actions/.github/workflows/test-github-actions.yaml@3f1ee42ffa54794a512d3989c34e3b4514de64cc # v0.43.1

Zizmor Refactoring

• release-mkdocs: implement zizmor recommendations and pin mkdocs<2.0 (#207) (4dd8c17)
• release-python-poetry: implement zizmor recommendations (#206) (45fae14)
• test-pre-commit: implement zizmor recommendations (#203) (f24dab7)
• release-ansible-collection: implement zizmor recommendations (#202) (59bbe0f)
• release-container: implement zizmor recommendations (#200) (94bcf38)
• schedule-trivy: implement zizmor recommendations (#201) (cd7eedc)

Chores

• formatting and names (#205) (89c0299)
• Update label for permissions in new workflow template (#198) (0b42ab1)
• security: Implement "ENISA TA for Secure Use of Package Managers" (#197) (d3e4144)
• add empty top-level permission blocks for all actions (#193) (19453f7)
• don't persist credentials in actions/checkout (#192) (d2fd885)