Container Image

2026.10.21.1

Fixed: The README logged in to ECR by exporting the password into a shell variable and passing --input password="$TOKEN", which records the password in cleartext with the method run. It now passes --input 'password=${{ vault.get("ecr", "PASSWORD") }}', which swamp resolves and redacts.

Added: A "Registry credentials" README section: an ECR password kept fresh by a vault refresh hook (swamp vault put … --refresh-from 'aws ecr get-login-password …'), the ECR credential helper as a password-free alternative, and an interactive swamp vault put flow for GHCR, DockerHub and other registries.

Changed: The login password argument description says to supply it with a vault.get expression.

Upgrade note: Documentation only; no behavioral or schema changes.

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

2026.08.24.1

Added: Output metadata attributes for observability.

• durationMs: Method execution duration in milliseconds.
• collectedBy: Extension name that produced the data.
• fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.23.1

Changed: Documentation only — no code changes. Added a ## Troubleshooting section covering the command global arg's default ("docker") and missing-binary spawn errors, --load failing on multi-platform builds (always appended for non-buildah CLIs), post-push digest-inspect failures when the local image store hasn't synced yet, push.size silently going null on parse failure, and the explicit "unknown"/null fallback values in inspect for images never pushed.

2026.08.21.2

Changed: Error messages across build, push, login, and inspect now name the operation and the image tag or registry involved, instead of surfacing raw CLI or runtime errors:

• If the container CLI binary itself fails to launch (e.g. it isn't installed or isn't on PATH), the error now says which command and arguments were attempted instead of a bare "No such file or directory".
• login failures now include the registry URL being authenticated against.
• After a successful build, the follow-up call that looks up the new image's ID no longer fails silently — if that lookup fails, build now throws an error saying the build succeeded but the image ID could not be retrieved, instead of writing a resource with an empty imageId.
• After a successful push, the follow-up calls that look up the pushed image's digest and size no longer fail silently — failures now throw with the tag and CLI exit code instead of writing a resource with an empty digest or a null size.
• inspect now reports a clear "failed to parse ... as JSON" error (including the tag and the parser's message) if the CLI's output isn't valid JSON, instead of an unqualified SyntaxError.

No schema or behavioral changes to successful operations — only error paths are affected.

2026.08.21.1

Changed: Added .describe(...) documentation to previously undocumented fields in BuildResultSchema, PushResultSchema, and InspectResultSchema. No behavioral changes.

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.27.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.18.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.18.1.

2026.07.27.1

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.27.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.18.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.18.1.

2026.07.27.1

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.

2026.07.18.1

Added: An upgrades array entry (no-op) to container_image.ts for proper typeVersion tracking on existing instances. No schema or behavior changes.

2026.07.13.1

Changed: Upgraded the test-only dev dependency @systeminit/swamp-testing to 0.20260504.10, matching the rest of the repo. This is a test-harness change only — the published extension bundle is unchanged and no runtime behavior is affected.

2026.07.13.1

Changed: Upgraded the test-only dev dependency @systeminit/swamp-testing to 0.20260504.10, matching the rest of the repo. This is a test-harness change only — the published extension bundle is unchanged and no runtime behavior is affected.