Changelog

All notable changes to the Mondoo Splunk apps are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

.github/workflows/release.yml: tag-driven release pipeline. Verifies the tag against both app.conf files and both app.manifest files, re-runs the CI gates against the tagged commit, packages both apps, checks the packages for local/, tests/ and token-shaped strings, and publishes a GitHub release with checksums. Tag pushes previously matched no workflow trigger at all.
vet.sh --package-only: packages without running AppInspect, so release artifacts and locally built ones come from the same code path.
bump-version.sh: sets the version across all five fields and refreshes [install] build in one step. The release workflow now also rejects a build number that has not increased since the previous tag — Splunk uses it to decide whether an install is an upgrade, and it had been static since the apps were created.

.github/workflows/ci.yml: exposed via workflow_call so the release workflow reuses the pipeline instead of duplicating it.
README.md: added an Acknowledgments section crediting Alexander Skripnik and Ilker Duman of Netdescribe, whose work on these apps landed inside the squashed initial commit and so is not visible in the git history.

Initial release.

LICENSE and per-app LICENSE copies (Apache-2.0).
mondoo_app/app.manifest with dependency on TA-mondoo and CIM mappings.
.gitignore covering Python caches, local/ overrides, AppInspect artifacts and IDE files.
CHANGELOG.md.

TA-mondoo/default/app.conf: added [package] check_for_updates, [install] state, [install] requires_splunk_version, and richer description.
mondoo_app/default/app.conf: filled [package] id, description, and install metadata.
TA-mondoo/app.manifest: expanded commonInformationModels, tightened targetWorkloads (no indexers — modular input must run on a single instance), corrected author/company.