Release v0.18.0

What's Changed

• build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.3 by @dependabot in #1217
• Create a command similar to build-minirootfs for CPIO by @mattmoor in #1177
• build(deps): bump github/codeql-action from 3.25.13 to 3.25.15 by @dependabot in #1221
• build(deps): bump sigs.k8s.io/release-utils from 0.8.3 to 0.8.4 by @dependabot in #1220
• Migrate the configuration locking to apko. by @mattmoor in #1222
• Merge architectures by @mattmoor in #1226
• Fix replacing symlinks by @jonjohnsonjr in #1225
• use retryable http client by default by @imjasonh in #1228
• Canonicalize the architecture. by @mattmoor in #1231
• build(deps): bump github.com/docker/docker from 24.0.9+incompatible to 26.1.4+incompatible in the go_modules group by @dependabot in #1232
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.3 to 4.0.4 by @dependabot in #1229
• build(deps): bump golangci/golangci-lint-action from 6.0.1 to 6.1.0 by @dependabot in #1233
• allow APK auth using assumable identity by @imjasonh in #1230
• build(deps): bump chainguard.dev/sdk from 0.1.21 to 0.1.22 by @dependabot in #1236
• build(deps): bump google.golang.org/api from 0.188.0 to 0.189.0 by @dependabot in #1235
• build(deps): bump google.golang.org/api from 0.189.0 to 0.190.0 by @dependabot in #1237
• build(deps): bump golang.org/x/sys from 0.22.0 to 0.23.0 by @dependabot in #1238
• auth: Wrap errors by @jonjohnsonjr in #1241
• build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0 by @dependabot in #1240
• build(deps): bump golang.org/x/time from 0.5.0 to 0.6.0 by @dependabot in #1239
• set basic chainguard auth by @imjasonh in #1242
• build(deps): bump step-security/harden-runner from 2.9.0 to 2.9.1 by @dependabot in #1243
• auth: Set username to "user" by @jonjohnsonjr in #1244
• build(deps): bump github.com/google/go-containerregistry from 0.20.1 to 0.20.2 by @dependabot in #1246
• build(deps): bump github/codeql-action from 3.25.15 to 3.26.0 by @dependabot in #1247
• build(deps): bump google.golang.org/api from 0.190.0 to 0.191.0 by @dependabot in #1249
• build(deps): bump github.com/docker/docker from 26.1.4+incompatible to 26.1.5+incompatible in the go_modules group by @dependabot in #1253
• build(deps): bump github.com/sigstore/cosign/v2 from 2.3.0 to 2.4.0 by @dependabot in #1245
• build(deps): bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by @dependabot in #1250
• build(deps): bump golang.org/x/sys from 0.23.0 to 0.24.0 by @dependabot in #1252
• build(deps): bump chainguard.dev/sdk from 0.1.22 to 0.1.23 by @dependabot in #1251
• build(deps): bump github.com/chainguard-dev/clog from 1.4.0 to 1.5.0 by @dependabot in #1254
• Bust global caches by default in index tests by @jonjohnsonjr in #1255
• drop dependency on heredoc by @imjasonh in #1258
• remove custom log package, charm supports it now by @imjasonh in #1257
• drop dependency on go.lsp.dev/uri by @imjasonh in #1259
• Revert "drop dependency on go.lsp.dev/uri" by @imjasonh in #1262
• build(deps): bump google.golang.org/api from 0.191.0 to 0.192.0 by @dependabot in #1268
• build(deps): bump k8s.io/apimachinery from 0.30.3 to 0.31.0 by @dependabot in #1267
• build(deps): bump github/codeql-action from 3.26.0 to 3.26.1 by @dependabot in #1266
• Expose type of DefaultAuthenticators by @jonjohnsonjr in #1272
• build(deps): bump github/codeql-action from 3.26.1 to 3.26.2 by @dependabot in #1271
• Expose DiscoverKeys by @jonjohnsonjr in #1273
• Wire up chainctl stderr to os.Stderr by @jonjohnsonjr in #1274
• build(deps): bump github/codeql-action from 3.26.2 to 3.26.3 by @dependabot in #1280
• new command: install-keys by @imjasonh in #1227
• build(deps): bump github/codeql-action from 3.26.3 to 3.26.4 by @dependabot in #1283
• build(deps): bump google.golang.org/api from 0.192.0 to 0.193.0 by @dependabot in #1282
• codeql needs security-events: write by @k4leung4 in #1281
• build(deps): bump google.golang.org/api from 0.193.0 to 0.194.0 by @dependabot in #1285
• build(deps): bump github/codeql-action from 3.26.4 to 3.26.5 by @dependabot in #1288
• build(deps): bump go.opentelemetry.io/otel/trace from 1.28.0 to 1.29.0 by @dependabot in #1286
• upgrade to golang 1.23 by @k4leung4 in #1278
• build(deps): bump google.golang.org/api from 0.194.0 to 0.195.0 by @dependabot in #1290
• build(deps): bump chainguard.dev/sdk from 0.1.23 to 0.1.24 by @dependabot in #1289
• auth: attempt CG auth if envs are configured by @imjasonh in #1279
• build(deps): bump github/codeql-action from 3.26.5 to 3.26.6 by @dependabot in #1291
• build(deps): bump golang.org/x/sys from 0.24.0 to 0.25.0 by @dependabot in #1294
• build(deps): bump google.golang.org/api from 0.195.0 to 0.196.0 by @dependabot in #1293
• Add LoongArch architecture definition by @kaniini in #1275
• build(deps): bump go.step.sm/crypto from 0.51.1 to 0.51.2 by @dependabot in #1292
• rsa256 by @xnox in #1256
• build(deps): bump step-security/harden-runner from 2.9.1 to 2.10.1 by @dependabot in #1295
• build(deps): bump go.step.sm/crypto from 0.51.2 to 0.52.0 by @dependabot in #1296
• build(deps): bump go.opentelemetry.io/otel/trace from 1.29.0 to 1.30.0 by @dependabot in #1299
• build(deps): bump go.opentelemetry.io/otel from 1.29.0 to 1.30.0 by @dependabot in #1297
• build(deps): bump google.golang.org/api from 0.196.0 to 0.197.0 by @dependabot in #1298

New Contributors

• @k4leung4 made their first contribution in #1281

Full Changelog: v0.17.0...v0.18.0