What's Changed

• Bump github.com/docker/docker from 20.10.13+incompatible to 20.10.14+incompatible by @dependabot in https://github.com/google/ko/pull/673
• Add purls to SPDX sbom by @puerco in https://github.com/google/ko/pull/677
• Bump actions/setup-go from 2 to 3 by @dependabot in https://github.com/google/ko/pull/680
• Bump sigstore/cosign-installer from 2.1.0 to 2.2.0 by @dependabot in https://github.com/google/ko/pull/683
• Bump codecov/codecov-action from 2.1.0 to 3.0.0 by @dependabot in https://github.com/google/ko/pull/682
• Bump actions/upload-artifact from 2 to 3 by @dependabot in https://github.com/google/ko/pull/681
• Bump ecr-login dep and update WithLogger callsite by @imjasonh in https://github.com/google/ko/pull/658
• check and use the latest go available for the defined version by @cpanato in https://github.com/google/ko/pull/690
• Bump k8s.io/apimachinery from 0.23.5 to 0.23.6 by @dependabot in https://github.com/google/ko/pull/691
• Bump codecov/codecov-action from 3.0.0 to 3.1.0 by @dependabot in https://github.com/google/ko/pull/692
• Bump github.com/spf13/viper from 1.10.1 to 1.11.0 by @dependabot in https://github.com/google/ko/pull/686
• Bump github.com/containerd/stargz-snapshotter/estargz from 0.11.3 to 0.11.4 by @dependabot in https://github.com/google/ko/pull/685
• Bump github.com/google/go-cmp from 0.5.7 to 0.5.8 by @dependabot in https://github.com/google/ko/pull/695
• Bump sigstore/cosign-installer from 2.2.1 to 2.3.0 by @dependabot in https://github.com/google/ko/pull/697
• Bump github/codeql-action from 1 to 2 by @dependabot in https://github.com/google/ko/pull/696
• Fix texts regarding SBOM by @otms61 in https://github.com/google/ko/pull/698
• Bump k8s.io/apimachinery from 0.23.6 to 0.24.0 by @dependabot in https://github.com/google/ko/pull/701
• Bump github.com/docker/docker from 20.10.14+incompatible to 20.10.15+incompatible by @dependabot in https://github.com/google/ko/pull/700
• Bump sigs.k8s.io/kind from 0.12.0 to 0.13.0 by @dependabot in https://github.com/google/ko/pull/703
• Bump github.com/docker/docker from 20.10.15+incompatible to 20.10.16+incompatible by @dependabot in https://github.com/google/ko/pull/704
• Bump sigs.k8s.io/kind from 0.13.0 to 0.14.0 by @dependabot in https://github.com/google/ko/pull/708
• Bump goreleaser/goreleaser-action from 2.9.1 to 3.0.0 by @dependabot in https://github.com/google/ko/pull/709
• Use sync.Map to cache base image lookups by @imjasonh in https://github.com/google/ko/pull/712
• Bump k8s.io/apimachinery from 0.24.0 to 0.24.1 by @dependabot in https://github.com/google/ko/pull/714
• Bump github.com/spf13/viper from 1.11.0 to 1.12.0 by @dependabot in https://github.com/google/ko/pull/715
• add warning when using both --local and KO_DOCKER_REPO to ko.local by @cpanato in https://github.com/google/ko/pull/629
• Bump gopkg.in/yaml.v3 from 3.0.0 to 3.0.1 by @dependabot in https://github.com/google/ko/pull/719
• Bump deps to silence security alerts by @imjasonh in https://github.com/google/ko/pull/667
• check if have all and other platforms set in the --platform flag by @cpanato in https://github.com/google/ko/pull/630
• Bump github.com/sigstore/cosign from 1.8.0 to 1.9.0 by @dependabot in https://github.com/google/ko/pull/721
• docs(readme): add sbom section by @developer-guy in https://github.com/google/ko/pull/710
• allow refs-file to be read by other users by @seankhliao in https://github.com/google/ko/pull/723
• Bump golang.org/x/tools from 0.1.10 to 0.1.11 by @dependabot in https://github.com/google/ko/pull/724
• Bump github.com/docker/docker from 20.10.16+incompatible to 20.10.17+incompatible by @dependabot in https://github.com/google/ko/pull/725
• Bump sigstore/cosign-installer from 2.3.0 to 2.4.0 by @dependabot in https://github.com/google/ko/pull/726
• build: Imply current import path by @imjasonh in https://github.com/google/ko/pull/717
• Allow KO_CONFIG_PATH to be a file by @benmoss in https://github.com/google/ko/pull/731
• Bump k8s.io/apimachinery from 0.24.1 to 0.24.2 by @dependabot in https://github.com/google/ko/pull/732
• Bump github.com/google/go-containerregistry from 0.9.0 to 0.10.0 by @dependabot in https://github.com/google/ko/pull/735
• Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 by @dependabot in https://github.com/google/ko/pull/734
• Update base image to ghcr.io/distroless/static:latest by @imjasonh in https://github.com/google/ko/pull/737
• Convert our SPDX SBOMs to spdx+json. by @mattmoor in https://github.com/google/ko/pull/740
• Fix off-by-one error by @mattmoor in https://github.com/google/ko/pull/742
• Add externalDocumentRefs to SPDX doc type by @puerco in https://github.com/google/ko/pull/741
• Bump sigstore/cosign-installer from 2.4.0 to 2.4.1 by @dependabot in https://github.com/google/ko/pull/746
• Unconditionally set the base image annotation. by @mattmoor in https://github.com/google/ko/pull/745
• Start emitting multi-arch SBOMs for SPDX with ko by @mattmoor in https://github.com/google/ko/pull/743
• Add base image information to SPDX SBOMs by @mattmoor in https://github.com/google/ko/pull/744
• don't fail if LDFLAGS env isn't set by @imjasonh in https://github.com/google/ko/pull/758
• Several SPDX SBOM adjustments. by @mattmoor in https://github.com/google/ko/pull/760
• Decorate per-architecture images with base image annotations. by @mattmoor in https://github.com/google/ko/pull/759
• Have --image-refs list all images for multi-arch builds. by @mattmoor in https://github.com/google/ko/pull/761
• remove deprecated k8s flags support by @imjasonh in https://github.com/google/ko/pull/750
• Reject the -toolexec flag by @imjasonh in https://github.com/google/ko/pull/752
• Add installation instructions for Alpine by @imjasonh in https://github.com/google/ko/pull/754
• ko run: remove --generator flag by @imjasonh in https://github.com/google/ko/pull/751
• exercise symlink chasing without .git by @imjasonh in https://github.com/google/ko/pull/763
• Chore: bumped base image to go 1.18 by @ellistarn in https://github.com/google/ko/pull/764
• Add a delimiter before digest in the SPDX namespace by @mattmoor in https://github.com/google/ko/pull/765
• Bump k8s.io/apimachinery from 0.24.2 to 0.24.3 by @dependabot in https://github.com/google/ko/pull/767
• Bump github.com/containerd/stargz-snapshotter/estargz from 0.11.4 to 0.12.0 by @dependabot in https://github.com/google/ko/pull/768
• Use chainguard-dev/actions/setup-registry by @imjasonh in https://github.com/google/ko/pull/772
• bump go-containerregistry dependency by @imjasonh in https://github.com/google/ko/pull/773
• Remove redundant return path by @jonjohnsonjr in https://github.com/google/ko/pull/774
• fix GitHub Actions workflows by @imjasonh in https://github.com/google/ko/pull/777
• Deprecate ko deps by @imjasonh in https://github.com/google/ko/pull/770
• Set layer media types consistently by @imjasonh in https://github.com/google/ko/pull/776
• Add kind e2e test for ko run by @imjasonh in https://github.com/google/ko/pull/779
• Add tests that ko can push to quay.io and Dockerhub by @imjasonh in https://github.com/google/ko/pull/778
• Fix e2e push tests, these registries need --bare by @imjasonh in https://github.com/google/ko/pull/780
• Bump github.com/sigstore/cosign from 1.9.0 to 1.10.0 by @dependabot in https://github.com/google/ko/pull/781
• Bump golang.org/x/tools from 0.1.11 to 0.1.12 by @dependabot in https://github.com/google/ko/pull/783
• Bump sigstore/cosign-installer from 2.4.1 to 2.5.0 by @dependabot in https://github.com/google/ko/pull/784
• Bump github.com/sigstore/cosign from 1.10.0 to 1.10.1 by @dependabot in https://github.com/google/ko/pull/786
• expose commands.ResolveFilesToWriter() method by @joshrwolf in https://github.com/google/ko/pull/787
• feat: generate SLSA provenance for release binaries by @laurentsimon in https://github.com/google/ko/pull/730
• adds org move message by @mchmarny in https://github.com/google/ko/pull/789
• update default base image to distroless.dev/static by @imjasonh in https://github.com/google/ko/pull/790
• Error if image platform does not match desired by @benmoss in https://github.com/google/ko/pull/785
• Bump k8s.io/apimachinery from 0.24.3 to 0.24.4 by @dependabot in https://github.com/google/ko/pull/792
• Bump github.com/sigstore/cosign from 1.10.1 to 1.11.0 by @dependabot in https://github.com/google/ko/pull/793
• Bump sigstore/cosign-installer from 2.5.0 to 2.5.1 by @dependabot in https://github.com/google/ko/pull/794
• Extend ko.local and kind.local detection to include sub-repos by @imjasonh in https://github.com/google/ko/pull/796
• Support --tag and --tag-only with nop publisher by @imjasonh in https://github.com/google/ko/pull/797

New Contributors

• @puerco made their first contribution in https://github.com/google/ko/pull/677
• @otms61 made their first contribution in https://github.com/google/ko/pull/698
• @seankhliao made their first contribution in https://github.com/google/ko/pull/723
• @ellistarn made their first contribution in https://github.com/google/ko/pull/764
• @joshrwolf made their first contribution in https://github.com/google/ko/pull/787
• @laurentsimon made their first contribution in https://github.com/google/ko/pull/730
• @mchmarny made their first contribution in https://github.com/google/ko/pull/789

Full Changelog: https://github.com/google/ko/compare/v0.11.2...v0.12.0