Community release v1.1.0

• Source commit: b61b47b468cfc5c837a5bde50eeafe52df4fe10d
• Images retagged from CI core-build-inventory digests (write-once)
• Public compose smoke test passed
• core-manifest.yaml attached (image digests, engine pins, schema ledger)
• CycloneDX SBOMs attached for all six images × linux/amd64 + linux/arm64 (12 assets: sbom-<component>-v1.1.0-linux-amd64|arm64.cdx.json)
• Image index manifests signed with Cosign (GitHub Actions OIDC / Fulcio keyless)

Verify Cosign signatures

IDENTITY_RE='^https://github\.com/SiriusScan/Sirius/\.github/workflows/publish-release-image-tags\.yml@refs/heads/main$'
ISSUER='https://token.actions.githubusercontent.com'
for c in sirius-ui sirius-api sirius-engine sirius-postgres sirius-rabbitmq sirius-valkey; do
  digest=$(crane digest "ghcr.io/siriusscan/${c}:v1.1.0")
  cosign verify --certificate-identity-regexp "${IDENTITY_RE}" --certificate-oidc-issuer "${ISSUER}" \
    "ghcr.io/siriusscan/${c}@${digest}"
done

Install with IMAGE_TAG=v1.1.0 against public GHCR.

Sirius v1.0.0

Initial production release of Sirius.

Highlights

• Merged v1 into main with release-candidate hardening and cleanup.
• Stabilized CI/CD workflows for reliable image build, publish, and integration validation.
• Added production compose overrides and improved environment/validation behavior in CI.
• Removed legacy development artifacts and example endpoints from the UI/API surface.
• Updated release documentation and changelog for v1.0.0.

Included release metadata

• Main repository tag: v1.0.0
• App Scanner tag: v1.0.0