Skip to content

v0.2.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Dec 03:54
v0.2.1
35c562d

This is a patch release focused on supply-chain hardening, provenance plumbing, and release automation.

No schema or CLI interface changes (report/score schemas remain as in v0.2.0).

Supply chain

  • Cosign keyless signing by digest for GHCR images (signs image@sha256:..., not tags).
  • SPDX SBOM published as a cosign attestation alongside the same image digest.
  • Workflow emits a digest + signature-reference summary on tag builds.

Published CPU image (immutable):

  • Digest: ghcr.io/omniscoder/crispr-gpu-cpu@sha256:c7e1cb3504f50b0b709179ee245a6093138c27828140f425d726b5983365035e
  • Signature ref: ghcr.io/omniscoder/crispr-gpu-cpu:sha256-c7e1cb3504f50b0b709179ee245a6093138c27828140f425d726b5983365035e.sig

Provenance

  • report.json captures container digest + build metadata via CRISPR_GPU_* environment variables.
  • Images bake build metadata so provenance is not “best effort” when run in-container.

Verification and citation rules

  • Verification instructions: docs/supply_chain.md
  • Do not cite :latest. For anything citeable/reproducible, cite a release tag (e.g. :v0.2.1) or (preferred) the immutable digest.

Canonical verification example (copy/paste digest format):

IMAGE_WITH_DIGEST="ghcr.io/omniscoder/crispr-gpu-cpu@sha256:c7e1cb3504f50b0b709179ee245a6093138c27828140f425d726b5983365035e"

cosign verify \
  --certificate-identity-regexp '^https://github.com/omniscoder/crispr-gpu/.github/workflows/docker-publish\.yml@refs/tags/v0\.2\.1$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  "${IMAGE_WITH_DIGEST}"

cosign verify-attestation \
  --type spdxjson \
  --certificate-identity-regexp '^https://github.com/omniscoder/crispr-gpu/.github/workflows/docker-publish\.yml@refs/tags/v0\.2\.1$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  "${IMAGE_WITH_DIGEST}"

Release surface

  • Release assets auto-attached: report.json, report.md, score_cpu.json, bench_synthetic.jsonl, plus the sample bundle tarball.
  • README includes a one-liner to run the demo and validate schemas via scripts/validate_artifacts.py.
Assets 8
Loading