v0.0.4

Changelog

• a7cd9a5 build(deps): bump Go to 1.26.4 and golang.org/x/sys to v0.44.0 (#57)
• ce27825 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#56)
• 3ef5519 build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.17 to 1.32.18 (#52)
• 1fecf4f build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.1.20 to 0.1.22 (#51)
• 5c3394b build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.100.1 to 1.101.0 (#47)
• cc8f31e build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#50)
• b77b587 build(deps): bump j178/prek-action from 2.0.3 to 2.0.4 (#49)
• df44d22 build(deps): bump pgregory.net/rapid from 1.2.0 to 1.3.0 (#46)
• ef7d22c build(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#45)
• e264e0c ci: add scheduled prek hook auto-update workflow (#54)
• 91113b1 ci: replace dependabot gomod updates with govulncheck + latest-deps tests (#55)
• 0f935ca feat(logging): log allowlisted HTTP headers across request lifecycle (#58)
• 3473152 fix: forward complete Accept header set to upstream (#59)
• b89a912 fix: stop mislabeling non-OCI transport errors as "oci auth" (#53)

v0.0.3

Changelog

• 4b7b39c Add configurable upstream timeouts with fast stale fallback (#42)
• 586ffd8 Bump deps: 2026-03-14
• fa48db9 Migrate to structured logging with log/slog (#19)
• 5613e51 build(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#12)
• 8cb96b8 build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#27)
• a4573c4 build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#11)
• 4b5bf20 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#36)
• abfcb9f build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.4 to 1.41.5 (#28)
• 614d15c build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.1.10 to 0.1.20 (#38)
• b068589 build(deps): bump github.com/aws/smithy-go from 1.24.2 to 1.25.1 (#35)
• 7b236bf build(deps): bump go directive from 1.26.0 to 1.26.3 (#43)
• e756a8b build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#7)
• df0573d build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 (#40)
• 5d573a5 build(deps): bump j178/prek-action from 1.1.1 to 2.0.0 (#23)
• 215d195 build(deps): bump j178/prek-action from 2.0.0 to 2.0.3 (#39)
• 31369f3 build(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 (#22)
• 97d2f1d build(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 (#26)
• b280296 build: migrate pre-commit to prek with parallel hook execution (#21)
• 2416f37 feat: add OCI Bearer token auth transport (#18)
• 94eb10e fix(oci): make service and scope optional in Bearer challenge parsing (#20)
• f1d0703 fix(s3): set Content-Type on S3 uploads from upstream response (#24)
• 7bacc22 fix(s3): treat 403 Forbidden as cache miss in HeadObject
• 9f86986 fix: lints after upgrade
• a09b407 refactor(log): unify upstream interaction logging in fetchAndCache

v0.0.2

Changelog

• c72b44d ci: disable setup-go module caching to avoid unpinned actions/cache
• 62945fe ci: replace pre-commit/action with pipx run to avoid unpinned actions/cache
• e682090 fix(ci): match goreleaser dist/ directory naming in artifact upload
• fa14bb1 fix(ci): upload binary artifacts instead of missing tar.gz files
• f7f0462 fix: extend On5xx fallback to cover full 5xx range and clarify error message
• f36c789 refactor: apply Go best-practice fixes from code review

v0.0.1

fix(build): sign checksums.txt instead of individual archives

The archive artifact filter wasn't matching either. Switch to signing
the checksums file, which goreleaser always produces and is the
conventional approach for cosign + goreleaser.