Copa hardened fixes - #259

Merged

bluvulture merged 3 commits into

5.xfrom

copa-hardened-fixes

Jul 21, 2026

Commits on Jul 21, 2026

release: make the hardened severity gate non-fatal (warn, don't fail the job)

bluvulture
and
claude
committed
attach-sbom: qualify bare Docker Hub refs as docker.io/ for oras

bluvulture
and
claude
committed
attach-sbom: follow Docker reference rules in registry normalization

bluvulture
and
claude
committed