• cosign(install): verify binary signature with keyless verification bundle by @crazy-max in #904
• docker(install): unpin QEMU by @crazy-max in #896
• build(deps): bump @actions/artifact from 4.0.0 to 5.0.1 in #893
• build(deps): bump @actions/cache from 4.1.0 to 5.0.1 in #892
• build(deps): bump @actions/core from 1.11.1 to 2.0.1 in #889
• build(deps): bump @actions/exec from 1.1.1 to 2.0.0 in #885
• update dev dependencies by @crazy-max in #902 #903

Full Changelog: v0.69.0...v0.71.0

• cosign(install): verify binary signature with keyless verification bundle by @crazy-max in #904
• docker(install): unpin QEMU by @crazy-max in #896
• build(deps): bump @actions/artifact from 4.0.0 to 5.0.1 in #893
• build(deps): bump @actions/cache from 4.1.0 to 5.0.1 in #892
• build(deps): bump @actions/core from 1.11.1 to 2.0.1 in #889
• build(deps): bump @actions/exec from 1.1.1 to 2.0.0 in #885
• update dev dependencies by @crazy-max in #902 #903

Full Changelog: v0.69.0...v0.70.0

• docker(install): pin QEMU to 10.1.1 by @crazy-max in #880

Full Changelog: v0.68.0...v0.69.0

• buildx(bake): funcs to check attest set in bake definition by @crazy-max in #873
• git: support getting ref in various detached HEAD contexts by @neilime in #856
• releases: download releases JSON without token first by @crazy-max in #875
• sigstore: remove verbose flag from persisted cosign args by @crazy-max in #854
• build(deps): bump js-yaml from 4.1.0 to 4.1.1 in #860
• build(deps): bump @actions/http-client from 2.2.3 to 3.0.0 in #831
• build(deps): bump @actions/io from 1.1.3 to 2.0.0 in #832

Full Changelog: v0.67.0...v0.68.0

• cache: gracefully handle cache restore failures with warning by @crazy-max in #842
• sigstore: remove @actions/attest dependency by @crazy-max in #843
• build(deps): bump @sigstore/bundle from 3.1.0 to 4.0.0 in #840
• build(deps): bump @sigstore/sign from 3.1.0 to 4.0.1 in #844

Full Changelog: v0.66.0...v0.67.0

• sigstore: multi image names support for signing by @crazy-max in #841
• build(deps): bump @octokit/request-error from 5.0.0 to 5.1.1 in #836
• build(deps): bump @octokit/request from 8.1.1 to 8.4.1 in #836

Full Changelog: v0.65.0...v0.66.0

• use github token to fetch releases JSON from CDN if available by @crazy-max in #819
• sigstore class to sign and verify BuildKit attestation manifests and provenance blobs by @crazy-max in #820 #830
• cosign install and command support by @crazy-max in #826 #827 #828 #825
• buildx(imagetools): return attestations digests by @crazy-max in #823
• docker(install): update lima images by @crazy-max in #821
• docker(install): don't use local system resolver with lima and increase timeouts by @crazy-max in #837 #839
• build(deps): bump @actions/artifact from 2.3.2 to 4.0.0 in #818

Full Changelog: v0.64.0...v0.65.0

• docker(install): fix source archive version by @crazy-max in #813
• docker(install): set missing XDG_RUNTIME_DIR env by @crazy-max in #763
• build(deps): bump @actions/cache from 4.0.3 to 4.1.0 in #762 #794
• build(deps): bump brace-expansion from 1.1.11 to 1.1.12 in #757
• build(deps): bump csv-parse from 5.6.0 to 6.1.0 in #739
• build(deps): bump semver from 7.7.2 to 7.7.3 in #807
• build(deps): bump tar from 6.1.13 to 6.2.1 in #755
• build(deps): bump tmp from 0.2.4 to 0.2.5 in #764
• build(deps): bump undici from 5.28.4 to 5.29.0 in #756

Full Changelog: v0.63.0...v0.64.0

• build(deps): bump @octokit/core from 5.1.0 to 5.2.2 by @crazy-max in #750
• build(deps): bump @octokit/plugin-rest-endpoint-methods from 10.4.0 to 10.4.1 by @crazy-max in #750
• build(deps): bump form-data from 2.5.1 to 2.5.5 in #743
• build(deps): bump tmp from 0.2.3 to 0.2.4 by @crazy-max in #750

Full Changelog: v0.62.1...v0.63.0

• github: fix summary handling for dbc by @crazy-max in #707

Full Changelog: v0.62.0...v0.62.1