v1.3.02026-06-02feature
- ·Agent v0.2.0 with production hardening: graceful SIGTERM forwarding to wrapped jobs (10s grace before SIGKILL), bounded ping contexts (no fork-bomb risk under API outage), shell-convention exit codes (signal-killed → 128+sig)
- ·Output redaction: capture_output toggle and redact_patterns (Go regexps) for stdout/stderr — line-buffered, runs before truncation so straddle secrets are still caught; host kubectl/cron logs stay raw
- ·Multiple install paths: brew install platops-security/tap/crond-agent, multi-arch Docker (ghcr.io/.../agent:0.2.0), deb/rpm packages, scratch container (~3-10 MB)
- ·Supply chain: cosign keyless signing of checksums.txt + docker manifests, Syft SBOMs per archive, install.sh signature verification (INSTALL_REQUIRE_SIG=1 makes it mandatory)
- ·Helm chart 0.2.0 with new agent.captureOutput / agent.redactPatterns values flowing into CROND_* env vars on the wrapped container
- ·Release automation: dockers_v2 multi-arch builds, pinned alpine base by digest, semver pre-flight + ancestor-of-main check on tag day, auto-PR to bump chart appVersion + image.tag after every agent release
- ·Nightly :nightly multi-arch image + rolling pre-release for bleeding-edge testing