All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
2.12.0 (2026-01-21)
- scanner-codeql: add auto-detection and configurable inputs (7415a32)
- scanner-codeql: enhance severity classification using CVSS and SARIF levels (df13aa0)
- scanner-codeql: correct SARIF directory paths in summary job (78be748)
- scanner-codeql: remove sparse-checkout for language detection (67f2596)
- scanner-codeql: severity counts in summary (18e09c3)
2.11.2 (2026-01-20)
- gitleaks: pr summary missing status when secrets found (a7118b0)
- gitleaks: update scanner-gitleaksref to use feature branch (8370fa0)
2.11.1 (2026-01-16)
- checkout hardening-worflows: missing checkout token (547e773)
- container-scan.yml: handle root directory case in Dockerfile naming (e1b6f0d)
- scanner-zap: missing use of secrets.HARDENING_WORKFLOWS_CHECKOUT_TOKEN (544b7f0)
- deps: bump anchore/sbom-action from 0.21.0 to 0.21.1 (0fec108)
- deps: bump the github-actions-major group across 1 directory with 4 updates (cc81382)
- release-it.json: remove deprecated version replacement (7290611)
- workflows: simplify hardening workflows checkout ref (8e289c6)
2.11.0 (2026-01-15)
- Enhance ZAP scanning workflows with multiple methods and configuration options (a8ee3fa)
- husky: enhance commit hooks with environment checks and improved error handling (af495b0)
- zap: add ZAP DAST scanner with config-file support (79dbc29)
- release-it.json: scanner-zap.yml version not updating (0c90612)
- dependencies: update ajv, ajv-formats, and js-yaml versions (83a617a)
- example-zap: update workflow to default to 'all' scan type and enhance condition checks (7f2b5ec)
- release-it.json: remove extra scanner-zap config (b17a6f9)
- scanner-zap: add example workflow for ZAP scanning methods and update config examples (4987a9a)
- scanner-zap: enhance matrix output with combined group metadata (eee09f5)
- scanner-zap: generate unique prefix from all inputs (c5a663f)
- scanner-zap: refactor matrix variable usage in workflow and parser (fcb64d0)
- scanner-zap: rename output variable for post PR comment in ZAP workflow (8748562)
- scanner-zap: update ZAP risk code handling to match severity levels (681011b)
- scanner-zap: update ZAP risk code mapping to reflect 1:1 severity levels (1257c3a)
- test-zap: add security-events permission for enhanced security handling (a79b7c0)
- zap-config.example: update fail_on_severity settings to 'none' for all scans (683fd64)
- zap-config: add inputs to defaults w/override options (7f4023e)
- zap: add example ZAP DAST scan workflow for Podinfo application (8bb9b3f)
- add security policy and reporting guidelines (07ad4c8)
- update license information from MIT to AGPL v3 (68a6dcc)
2.10.0 (2026-01-05)
- add digest to container scan summary (53af4f6)
- container-scanners: add composite action and remote registry scanning (ab1c321)
- container-scanners: add config-driven matrix scanning (127ae09)
- container-scanners: add remote registry authentication support (bcb47ca)
- deps: bump bridgecrewio/checkov-action (81320bb)
- deps: bump @commitlint/cli from 20.2.0 to 20.3.0 (bc34f9d)
- container-config-schema: consolidate registry configuration (49d4641)
- container-scan-from-config: enhance registry authentication and environment variable support (4ea3b81)
- restructure and consolidate to improve readability and flow (342bbd0)
- container-scan: extract inline scripts to external files (85a3191)
2.9.1 (2025-12-29)
- deps: bump anchore/sbom-action from 0.20.11 to 0.21.0 (68fc8b8)
- deps: bump bridgecrewio/checkov-action (625294b)
- deps: bump @release-it/conventional-changelog (2915436)
- deps: bump release-it from 19.1.0 to 19.2.2 (22a15dd)
2.9.0 (2025-12-21)
- gitleaks: add organization license and configuration support b17e00a
- reusable-security-hardening: reusable workflow not passing GITLEAKS_LICENSE from org secrets a60715b
- update reusable workflow example and README w/detailed scanner options and descriptions 5e65c1d
2.8.1 (2025-12-16)
- deps: bump anchore/sbom-action from 0.20.10 to 0.20.11 f302689
- deps: bump @commitlint/cli from 20.1.0 to 20.2.0 (#84) 5cc7c24
- deps: bump @commitlint/config-conventional from 20.0.0 to 20.2.0 (#83) 5f1dd6d
- deps: bump @release-it/conventional-changelog 81d0e26
- deps: bump release-it from 19.0.6 to 19.1.0 ec15994
- deps: bump the github-actions-major group with 2 updates cd16739
2.8.0 (2025-12-14)
- container-scan: add detailed scanner breakdown with deduplication (a0f49e6)
- scanners: improve vuln summary details (5a64ad3)
- comment pr: update max character count (f2fdeae)
- container-scan: prevent early exit on Grype severity threshold (0ab3713)
- grype: use output-file parameter instead of action outputs (5729d2a)
- checkov: remove detailed check summaries for grouped by rule and passed checks (cbe9749)
- infrastructure-scan: default trivy findings details section to be closed (ad4575f)
- scanner-trivy-iac: add vuln links (397f66e)
- test-docker: bump express (#79) (e7d8af8)
- scanners: limit vulnerability table output to 50 rows (6d0a31e)
2.7.0 (2025-12-07)
- add sarif extra dependency for Bandit SARIF output support (d19e004)
- correct Bandit critical threshold behavior - Bandit has no critical level (b0ac80f)
- add allow_failure and severity_threshold documentation (6de36d3)
2.6.0 (2025-12-02)
- container-scan: add unique CVE column to summary totals (ec99c3f)
- container-scan: summary PR comment separated by container name (9c64431), closes #78
- container-scan-summary: incorrect trivy vuln counts (9cf052a), closes #74
- pr-verification: container-scan.yml changes not triggering workflows (bb47c3d), closes #77
- trivy: vuln table not displaying (f159e2c), closes #75
- deps: bump bridgecrewio/checkov-action (b6fbc9b)
- deps: bump actions/checkout in the github-actions-major group (2d6bcfd)
- .release-it.json: update to improve changelog handling (bda1287)
- container-scan: remove docker emoji from summary (0934258)
- container-scan: skip sbom files found in container_dir (20ea5bf)
- container-scan: vulnerability summary in job summary and reports (8c76557)
- pr-verification: add contianer-scan to any_scanner (9d4d308)
- reusable-security-hardening.yml: temporarily set container-scan.yml ref to feat branch (134b90e)
2.5.8 (2025-11-18)
- deps: bump anchore/sbom-action from 0.20.9 to 0.20.10 (fccfc4e)
- deps: bump bridgecrewio/checkov-action (1afe4f4)
- deps: bump @release-it/conventional-changelog (0bd7763)
- deps: bump js-yaml from 4.1.0 to 4.1.1 (30761d1)
- .release-it.json: regex for all refs in QUICK-START.md and README.md (260df17)
- release-it-process-changelog.js: add debug logging (f8ba371)
- release: v2.5.7 (b2856bb)
- dependabot: consolidate minor and patch updates for GitHub Actions and Docker (aea0ac1)
2.5.7 (2025-11-18)
2.5.6 (2025-11-11)
- deps: bump bridgecrewio/checkov-action (a3b586e)
- deps: bump release-it from 19.0.5 to 19.0.6 (c1cc96c)
- .release-it.json: restructure to use preset.name as before (980ba98)
- .release-it.json: update to improve changelog handling (3933e45)
- package-lock.json: regenerate for npm consistency (ff8c21c)
- package-lock.json: remove unused conventional-commits-parser dependency (2189d8e)
- add Code of Conduct to promote a respectful community (5469bef)
2.5.5 (2025-11-04)
- deps: bump bridgecrewio/checkov-action (d8dc4a6)
- deps: bump @octokit/plugin-paginate-rest in the npm-major group (3463a53)
- add templates for bug reports, feature requests, and PRs (270ae1d)
2.5.4 (2025-10-29)
2.5.3 (2025-10-29)
- pr-reusable-security-hardening: add 'actions: read' permission to linting job (8da25b6)
- update condition for validating workflow sync to include any scanner changes (da852cc)
- deps)(deps: bump anchore/sbom-action from 0.20.8 to 0.20.9 (8cdb71d)
- deps)(deps: bump bridgecrewio/checkov-action (c6f125b)
- deps)(deps: bump the github-actions-major group with 3 updates (168567e)
- deps: bump @octokit/plugin-paginate-rest from 13.2.0 to 13.2.1 (c03a077)
- CONTRIBUTING: add instructions for updating release-it-process-changelog (ae51bff)
- changelog: categorize security tool updates in release changelog (07eeeee)
- dependabot: fix double scoped commit (c3217a0)
- pr-verification.yml: handle skipped tests in PR verification workflow (6494b7a)
2.5.2 (2025-10-24)
- reusable-security-hardening: add 'actions: read' permissions to (d030310)
2.5.1 (2025-10-24)
- linting.yml: add permissions to read contents and actions in linting workflow (4397e26)
2.5.0 (2025-10-24)
- add ClamAV malware into PR verification workflow (56ef41b)
- clamav: add ClamAV malware scanner with archive extraction (4384ed1)
- workflows: add composite action for unique artifact naming (ed34421)
- release-it: reusable workflow versions not updating (cbad3e3)
- reusable-security-hardening.yml: scanners: all not running all 13 scanners (92b1273)
- update CONTRIBUTING.md to clarify workflow integration for new scanners (76ab04f)
- pr-verification: remove redundant code quality checks (b02b281)
- clamav: replace rglob with iterdir for faster directory scanning (955b1a7)
- add comprehensive test suites for extract-archives.py and parse-clamav-report.py (449beb1)
- release-it: update reusable-security-hardening.yml pattern to match any ref (b8c153a)
2.4.0 (2025-10-21)
- ci: add conditional scanner testing based on file changes (f472660)
- ci: add PR testing workflow with relative paths for scanner validation (53b7dff)
- ci: implement workflow synchronization validation script (bdae6da)
- ci: enable release preview and PR verification workflows for forked PRs (ce559d9)
- ci: update checkout ref to use pull request head ref (9d20643)
- update SBOM summary to reflect dynamic Syft version (633851e)
- LICENSE.md: include text of GNU Affero GPL (4e4fe09), closes #42
- LICENSE.md: remove duplicated verbiage (791bdef)
2.3.1 (2025-10-18)
2.3.0 (2025-10-18)
- Add SBOM generation to hardening pipeline (e5a0344)
- Update conditions for release and dry-run jobs in workflow (afa1462)
2.2.0 (2025-10-17)
- scanners: extract individual scanner workflows for modular usage (b86f74f)
- release-it: reusable workflow versions not updating (3512942)
- release: update GITHUB_TOKEN usage to support RELEASE_BOT_TOKEN for automated releases (eb6aeda)
- deprecate legacy workflows (f813c55)
- update Trivy and Checkov actions to use pinned versions (15a0e6e)
- deps: organize Dependabot PRs by level (09e1ff0)
2.1.1 (2025-10-16)
2.1.0 (2025-10-12)
- implement automated release system with preview functionality (cb64ef5)