@codedependant/semantic-release-docker 7.0.0 → 8.0.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Semantic Release Docker
 
+# [8.0.0](https://github.com/esatterwhite/semantic-release-docker/compare/v7.0.0...v8.0.0) (2026-08-29)
+
+
+### Bug Fixes
+
+* **image**: the allow the provenance flags to be passed through [ccb318d](https://github.com/esatterwhite/semantic-release-docker/commit/ccb318d9bc88b32cab721b81c415fcd350b26d73) - Eric Satterwhite, closes: [#64](https://github.com/esatterwhite/semantic-release-docker/issues/64)
+
+
+### Chores
+
+* **compose**: regenerate ssl certs for compose [a8f9b1a](https://github.com/esatterwhite/semantic-release-docker/commit/a8f9b1aca29b2377dd661d6738efe58575f2a9ff) - Eric Satterwhite
+
+
+### **BREAKING CHANGES**
+
+* **image:** boolean flags ([secure]) are no longer stripped
+* **image:** the provenance flag is no longer removed
+
 # [7.0.0](https://github.com/esatterwhite/semantic-release-docker/compare/v6.1.1...v7.0.0) (2026-04-29)
 
 

package/README.md

@@ -73,6 +73,25 @@ Platform specific builder must be setup and selected for this plugin to utilize
 > and normal docker commands targeting those images will not work.
 > The `dockerVerifyCmd` behavior will only trigger a build and is unable to execute local command
 
+#### Provenance Attestations
+
+When pushing to a registry, [buildx][] attaches a [provenance attestation][provenance] (`mode=min`) to
+the image index by default. This adds extra `unknown/unknown` manifests to the index, which some
+registries and container runtimes reject outright - notably AWS Lambda container images.
+
+Provenance (and SBOM) attestations can be configured via `dockerBuildFlags`:
+
+```javascript
+{
+  dockerBuildFlags: {
+    provenance: false
+  , sbom: false
+  }
+}
+```
+
+Alternatively, set `BUILDX_NO_DEFAULT_ATTESTATIONS=true` in the environment the release runs in.
+
 ### Build Arguments
 
 By default several build arguments will be included when the docker images is being built.
@@ -327,3 +346,4 @@ $ openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout server.key -o
 [Number]: https://mdn.io/number
 [--cache-from]: https://docs.docker.com/engine/reference/commandline/build/#cache-from
 [buildx]: https://docs.docker.com/reference/cli/docker/buildx/build
+[provenance]: https://docs.docker.com/build/metadata/attestations/slsa-provenance/#create-provenance-attestations

package/lib/docker/image.js

@@ -155,6 +155,12 @@ class Image {
       }
 
       for (const item of value) {
+        // booleans must use the --flag=value form so the value is not
+        // dropped as falsey when the command is assembled
+        if (typeof item === 'boolean') {
+          output.push(`${normalized}=${item}`)
+          continue
+        }
         output.push(normalized, item)
       }
     }
@@ -195,7 +201,6 @@ class Image {
 
   get buildx_cmd() {
     if (!this.is_buildx) return
-    this.opts.flags.delete('provenance') // incompatible with load/push
     this.opts.flags.delete('output') // alias of load/push
     this.opts.flags.delete('load')
     this.opts.flags.set('platform', [this.opts.platform.join(',')])

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@codedependant/semantic-release-docker",
   "private": false,
-  "version": "7.0.0",
+  "version": "8.0.0",
   "description": "docker package",
   "main": "index.js",
   "files": [
@@ -23,7 +23,7 @@
     "lint": "eslint .",
     "lint:fix": "npm run lint -- --fix",
     "local": "env $(cat env/local.env)",
-    "pretap": "npm run lint",
+    "pretap": "tap build && npm run lint",
     "release": "npx semantic-release",
     "release:dry": "npm run release -- --no-ci --dry-run --branches=${BRANCH_NAME:-main}"
   },
@@ -44,6 +44,9 @@
     "browser": false,
     "show-full-coverage": true,
     "output-file": ".tap-output",
+    "plugin": [
+      "!@tapjs/typescript"
+    ],
     "files": [
       "test/unit",
       "test/integration"