Release v0.6.3

Bug

• Revert handling of mixed case action identifiers.

Release v0.6.2

Enhancements

• Handle mixed case action identifiers.
• Reject checksum entries containing carriage return characters.

Security

• Upgrade Go to v1.25.5.

Release v0.6.1

Bugs

• Cover the actions and workflows used in local actions and reusable workflows.

Security

• Upgrade Go to v1.25.0.

Release v0.6.0

Enhancements

• Expand the program output on success.
• Add the ghasum list subcommand to get a nested list of GitHub Actions
  dependencies for the target.
• Include archived status in the ghasum list output.
• Request a bug report when a panic occurs.

Security

• Upgrade Go to v1.24.4.

Release v0.5.2

Bugs

• Fix verifying a non-job target identified by the absolute path on Windows.
• Fix various cases where files or directories could not found on Windows.

Release v0.5.1

Enhancements

• Report redundant checksums on verification of an entire repository.

Bugs

• Fix errors for actions with a Dockerfile manifest.
• Fix unexpected error due to Windows-style newlines in the sumfile.

Release v0.5.0

Enhancements

• Correct typo in the ghasum help verify output.
• Correct typo in the ghasum verify output.
• Enable cache eviction on ghasum init.
• Ensure ghasum verify outcome is linked to gha.sum content.
• Include reusable workflows in gha.sum, including transitive actions used in
  reusable workflows.

Release v0.4.0

Enhancements

• Include transitive actions in gha.sum (opt-out available).
• Improve performance of cloning repositories at a commit.

Bugs

• Fix errors for uses: values with local actions.
• Fix errors for uses: values with Docker Hub actions.

Security

• Upgrade Go to v1.24.2.

Miscellaneous

• Improve reproducibility by using -trimpath.

Release v0.3.0

Enhancements

• Improve behavior for sumfiles with duplicate entries.
• Add -offline verification support
• Add cache eviction support.
• Make ghasum update preserve existing checksums by default.

Bugs

• Fix behavior for sumfiles with duplicate entries.

Security

• Bump Go to v1.23.5

Miscellaneous

• Improve reproducibility by using -trimpath.

Release v0.2.0

Enhancements

• Support validating a single workflow.
• Support validating a single job in a workflow.
• Make ghasum update error if the gha.sum file is corrupted.

Bugs

• Unlock gha.sum if an error occurs during updating.
• Correct parsing uses values with multiple @ characters.

Security

• Upgrade from Go 1.22.0 to Go 1.22.1