Release/v1.10.x

.github/workflows/backport.yaml

@@ -7,6 +7,6 @@ jobs:
     permissions:
       contents: write # for reading and creating branches.
       pull-requests: write # for creating pull requests against release branches.
-    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.17.0
     secrets:
       github-token: ${{ secrets.BOT_GITHUB_TOKEN }}

.github/workflows/cifuzz.yaml

@@ -11,7 +11,7 @@ jobs:
       contents: read # for reading the repository code.
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0
         with:
           go-version: 1.27.x
       - name: Smoke test Fuzzers

.github/workflows/e2e.yaml

@@ -13,7 +13,7 @@ jobs:
       contents: read # for reading the repository code.
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0
         with:
           go-version: 1.27.x
       - name: Verify
@@ -39,7 +39,7 @@ jobs:
       contents: read # for reading the repository code.
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0
         with:
           go-version: 1.27.x
       - name: Setup Flux CLI

.github/workflows/release.yaml

@@ -15,7 +15,7 @@ jobs:
       contents: write # for creating the GitHub release.
       id-token: write # for creating OIDC tokens for signing.
       packages: write # for pushing and signing container images.
-    uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.17.0
     with:
       controller: ${{ github.event.repository.name }}
       release-candidate-prefix: ${{ github.event.inputs.tag }}

.github/workflows/scan.yaml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: read # for reading the repository code.
       security-events: write # for uploading the CodeQL analysis results.
-    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.17.0
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}
       fossa-token: ${{ secrets.FOSSA_TOKEN }}

.github/workflows/sync-labels.yaml

@@ -11,6 +11,6 @@ jobs:
     permissions:
       contents: read # for reading the labels file.
       issues: write # for creating and updating labels.
-    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.17.0
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0
         with:
           go-version: 1.27.x
       - name: Run tests

.github/workflows/upgrade-fluxcd-pkg.yaml

@@ -5,6 +5,6 @@ on:
 
 jobs:
   upgrade-fluxcd-pkg:
-    uses: fluxcd/gha-workflows/.github/workflows/upgrade-fluxcd-pkg.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/upgrade-fluxcd-pkg.yaml@v0.17.0
     secrets:
       github-token: ${{ secrets.BOT_GITHUB_TOKEN }}

.goreleaser.yaml

@@ -44,14 +44,11 @@ sboms:
 # https://goreleaser.com/customization/sign
 signs:
   - cmd: cosign
-    env:
-      - COSIGN_EXPERIMENTAL=1
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sigstore.json"
     args:
       - sign-blob
       - "--yes"
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}"
       - "${artifact}"
     artifacts: checksum
     output: true

CHANGELOG.md

@@ -2,6 +2,112 @@
 
 All notable changes to this project are documented in this file.
 
+## 1.10.0
+
+**Release date:** 2026-10-24
+
+This minor release graduates object-level workload identity, now renamed to
+object identity, introduces SPIFFE mTLS between the controllers, and adds
+GitHub App Client ID support for Git repositories.
+
+### Object Identity
+
+Object-level workload identity is now generally available and renamed to object
+identity. Workload identity refers exclusively to identities assigned to Flux
+controllers, while object identity refers to identities assigned to Flux
+objects. The `ObjectLevelWorkloadIdentity` feature gate is retired and the
+feature is always enabled.
+
+⚠️ **Breaking change:** the default Flux RBAC no longer grants the `create`
+verb on the `serviceaccounts/token` resource. If your installation relies on
+the default RBAC, bind a ClusterRole with this permission to the controller
+ServiceAccount before upgrading. See
+[fluxcd/flux2#6139](https://github.com/fluxcd/flux2/pull/6139) for the required
+ClusterRole and ClusterRoleBinding, and the
+[object identity documentation](https://fluxcd.io/flux/integrations/object-identity/)
+for the API reference.
+
+Two credential providers can now supply the credential: `kubernetes`, which
+uses the Kubernetes TokenRequest API and was already available, and `spiffe`,
+which fetches a JWT-SVID from the SPIFFE Broker API. The provider is configured
+on the ServiceAccount with `credential.auth.fluxcd.io/provider`, independently
+of the service provider in `.spec.provider`.
+
+### Inter-Controller mTLS
+
+This release introduces SPIFFE mTLS for inter-controller communication. Flux
+controllers authenticate each other with X.509-SVIDs, and each traffic type is
+enabled independently by configuring the SPIFFE Workload API socket and the
+SPIFFE IDs that the controller authorizes. See the
+[inter-controller mTLS documentation](https://fluxcd.io/flux/installation/configuration/intercontroller-mtls/)
+for the controller flags and an example configuration.
+
+### GitRepository
+
+GitHub App authentication accepts a Client ID as an alternative to the numeric
+App ID (`githubAppClientID`). Signature verification is re-run when the trusted
+keys rotate, so a revoked or replaced key no longer leaves a stale
+`SourceVerified=True` condition.
+
+### OCIRepository
+
+Generic OCI repositories now support object identity. The credential is sent as
+a bearer token, or as the password in HTTP basic authentication when
+`credential.auth.fluxcd.io/username` is set. Audiences default to the registry
+host and can be overridden with `credential.auth.fluxcd.io/audiences`.
+
+Signature verification is re-run when the verification keys rotate, and the
+origin revision from OCI image metadata is forwarded in events.
+
+### ExternalArtifact
+
+A new `.status.exportedInputs` field exposes structured data extracted from the
+source resource, for consumers such as ResourceSet to implement templating.
+
+### General updates
+
+The controller is built with Kubernetes 1.37 and Go 1.27.
+
+Fixes:
+- Close GCP object streams on error paths
+  [#2053](https://github.com/fluxcd/source-controller/pull/2053)
+- Close Azure blob streams on error paths
+  [#2200](https://github.com/fluxcd/source-controller/pull/2200)
+- Remove leaked Helm index cache on reconcile errors
+  [#2201](https://github.com/fluxcd/source-controller/pull/2201)
+  [#2202](https://github.com/fluxcd/source-controller/pull/2202)
+- Purge stale temp dirs at startup
+  [#2176](https://github.com/fluxcd/source-controller/pull/2176)
+- Include the repository URL in Helm index parse errors
+  [#2063](https://github.com/fluxcd/source-controller/pull/2063)
+- Support the AWS `ap-southeast-6` region for Bucket sources
+  [#2183](https://github.com/fluxcd/source-controller/pull/2183)
+
+Improvements:
+- Support Kubernetes ServiceAccount tokens for `generic` OCI repositories
+  [#2192](https://github.com/fluxcd/source-controller/pull/2192)
+- Add the `spiffe` credential provider and SPIFFE Broker API
+  [#2197](https://github.com/fluxcd/source-controller/pull/2197)
+- Retire the `ObjectLevelWorkloadIdentity` feature gate
+  [#2197](https://github.com/fluxcd/source-controller/pull/2197)
+- Add SPIFFE mTLS between the controllers
+  [#2194](https://github.com/fluxcd/source-controller/pull/2194)
+- Add GitHub App Client ID support
+  [#2168](https://github.com/fluxcd/source-controller/pull/2168)
+- Reverify sources when verification keys rotate
+  [#2166](https://github.com/fluxcd/source-controller/pull/2166)
+  [#2179](https://github.com/fluxcd/source-controller/pull/2179)
+- Expose the OCI origin revision in events
+  [#2127](https://github.com/fluxcd/source-controller/pull/2127)
+- Add ExternalArtifact exported inputs
+  [#2182](https://github.com/fluxcd/source-controller/pull/2182)
+- Update to Kubernetes 1.37 and Go 1.27
+  [#2162](https://github.com/fluxcd/source-controller/pull/2162)
+  [#2186](https://github.com/fluxcd/source-controller/pull/2186)
+- Various dependency updates
+  [#2100](https://github.com/fluxcd/source-controller/pull/2100)
+  [#2203](https://github.com/fluxcd/source-controller/pull/2203)
+
 ## 1.9.6
 
 **Release date:** 2026-10-01

config/manager/kustomization.yaml

@@ -6,4 +6,4 @@ resources:
 images:
 - name: fluxcd/source-controller
   newName: fluxcd/source-controller
-  newTag: v1.9.0
+  newTag: v1.10.0

go.mod

@@ -42,7 +42,7 @@ require (
 	github.com/fluxcd/pkg/tar v1.4.0
 	github.com/fluxcd/pkg/testserver v0.15.0
 	github.com/fluxcd/pkg/version v0.20.0
-	github.com/fluxcd/source-controller/api v1.9.0
+	github.com/fluxcd/source-controller/api v1.10.0
 	github.com/go-git/go-billy/v5 v5.9.2
 	github.com/go-git/go-git/v5 v5.19.3
 	github.com/go-logr/logr v1.4.4