# Changelog

## [1.1.2](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/compare/gemma-deployment-security-v1.1.1...gemma-deployment-security-v1.1.2) (2026-06-24)


### Bug Fixes

* **gemma-deployment-security:** warn that cap_drop ALL is not a universal drop-in ([#146](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/issues/146)) ([18edeaf](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/commit/18edeaf7ee26c420b4ed9cf14c0db53bfe294ee6))

## [1.1.1](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/compare/gemma-deployment-security-v1.1.0...gemma-deployment-security-v1.1.1) (2026-05-22)


### Bug Fixes

* **gemma-deployment-security:** remove disable-model-invocation from read-only audit skills ([#139](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/issues/139)) ([7ff095b](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/commit/7ff095b7ba00cdf710901ed3c5fb0448553b846d))

## [1.1.0](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/compare/gemma-deployment-security-v1.0.0...gemma-deployment-security-v1.1.0) (2026-05-08)


### Features

* **gemma-deployment-security:** add security audit plugin ([#113](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/issues/113)) ([c88363f](https://github.com/Gemma-Analytics/gemma-agentic-toolkit/commit/c88363fadf7854b33dec194af95200dd08ef2740))

## [1.0.0] - 2026-04-15

### Added

- `audit-docker-compose` skill: audits Docker Compose files for port bindings, network segmentation, non-root users, capabilities, secrets handling, image pinning, resource limits
- `audit-dockerfile` skill: audits Dockerfiles for secrets in build layers, credential patterns, image pinning, USER directive, multi-stage leakage
- `audit-cicd-workflows` skill: audits GitHub Actions workflows for action SHA pinning, environment protection, secrets handling
- `audit-server-config` skill: audits server configuration via SSH or guided checklist (UFW, sshd_config, fail2ban, sudo scope)
- `audit-infrastructure-as-code` skill: audits OpenTofu + Ansible deployments for firewall rules, secret handling, file permissions
- `audit-airflow-config` skill: audits Airflow-specific security (fernet key, webserver auth, executor security, DAG permissions)
- `generate-security-report` skill: orchestrates all audit skills and produces a unified prioritized Markdown report