Release v0.6.0

[balcsida]

Summary

Prepare v0.6.0 with chart version/appVersion 0.6.0 and a changelog entry covering everything merged since v0.5.0: the opt-in Dependencies & Licenses module (native stack #114, PRs #104–#113).

• GHES dependency-graph SBOM collection with byte-preserving snapshots, the /supply-chain page, and /v1/supply-chain/... (docs(supply-chain): accept ADR-0017 and the execution plan #104–feat(webui): Dependencies & Licenses inventory page, docs, and deployment wiring #107)
• exact-version license evidence from configured npm/NuGet/Maven routes with the pinned SPDX List 3.27.0 parser (feat(supply-chain): exact-version license evidence and assessments #108)
• portfolio overview, components, facets, CSV export, and snapshot comparison (feat(supply-chain): portfolio overview, components, export, and comparison #109)
• SPDX 2.3 / CycloneDX 1.6 imports and the derived SPDX export (feat(supply-chain): SPDX and CycloneDX imports with derived SPDX export #110)
• review queue, human conclusions, decisions, policies, grants, and audit events (feat(supply-chain): policies and review workflow #111)
• read-only MCP tools (feat(mcp): read-only dependency inventory tools #112)
• snapshot retention, history pruning, pilot checklist, and query plans (feat(supply-chain): retention, operations docs, and query-plan evidence #113)

Upgrade guidance: migrations 033–036 add the supply_chain_* tables; the module is off unless GRAPHNEST_SUPPLY_CHAIN=true; no registry traffic without a configured route. Collector behaviour is verified against recorded fixtures only — live GHES and registry validation is pending (see docs/supply-chain-pilot-checklist.md).

Validation

• make helm-lint helm-test release-chart-test on this branch — pass
• The merged stack head (0def80c, tree identical to 30afa59) passed the hosted CI workflow (verify, integration, e2e, helm) on every layer, plus the full local gate recorded in docs/execplans/supply-chain.md
• Both commits are signed by GitHub (created through the API because the local signing agent was unavailable overnight); the tree equals the locally prepared branch

Implications

Documentation and chart version only; no code changes beyond the stack already on main.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.