feat: implement Windows MarkdownViewr #35

2026-10-12T18:23:05Z

KofTwentyTwo commented

2026-10-12 18:23:05 +00:00

(Migrated from github.com)

This replaces the blocked history in PR #3 with one properly attributed, signed/DCO commit. The owner personally reviewed and approved PR #3 in the release session.

No file changes from the approved candidate: both baee14f492 and e605df62c4 have exact Git tree a85912cbad. Original PR #3 and its commits are preserved for review history. Historical commits were locally signed but GitHub reported no_user; protected merge checks those introduced commits even for squash merging. This commit resolves attribution without bypassing or weakening signature rules.

The reader, Settings, themes, source highlighting/split, live reload, file associations, Print/PDF, About credits, toolbar/footer/editor fixes, user-first README/screenshots and developer guides are exactly the approved implementation. Stable/dev separation and protected Azure signing caller are unchanged.

Evidence:

Approved tree baee14f / CI38285775463 passes all checks. Downloaded focused29/29, published111/111, stable110/110 and dev110/110 TRXs have zero failures/skips. Core coverage100% lines/98.86% branches; actual update/restart/coexistence/default-preservation receipts verify.
New single-commit hooks, online workflow security, signing and DCO pass. GitHub must rerun all required checks on this commit; results are not copied across SHAs.
Live repository setup validates18 Actions-bound checks, with only fuzzing added and all prior protections preserved.
OpenSSF project15417 is now owner-reviewed and saved at70% under owner-confirmed CDLA-Permissive2.0. This is an in-progress assessment, not a passing badge.
Production CI OIDC and signed1.0/dev publication remain required; local representative signing is not CI proof.

Substantial AI assistance: Codex (GPT-6). Supersedes PR #3. Release work remains tracked in #33.

Closes #4, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15, #16, #17, #18, #19, #20, #21, #22, #23, #24, #25, #26, #27, #28, #29, #32, #34.
Refs #1, #5, #30, #31, #33.

This replaces the blocked history in PR #3 with one properly attributed, signed/DCO commit. The owner personally reviewed and approved PR #3 in the release session. **No file changes from the approved candidate:** both baee14f492d1dd345d77df03c76623d4ee07b6e5 and e605df62c4eee8717c57cf4401482c113ecb4171 have exact Git tree a85912cbad0330664cbddac32f8ca17973fd2c09. Original PR #3 and its commits are preserved for review history. Historical commits were locally signed but GitHub reported no_user; protected merge checks those introduced commits even for squash merging. This commit resolves attribution without bypassing or weakening signature rules. The reader, Settings, themes, source highlighting/split, live reload, file associations, Print/PDF, About credits, toolbar/footer/editor fixes, user-first README/screenshots and developer guides are exactly the approved implementation. Stable/dev separation and protected Azure signing caller are unchanged. Evidence: - Approved tree baee14f / CI38285775463 passes all checks. Downloaded focused29/29, published111/111, stable110/110 and dev110/110 TRXs have zero failures/skips. Core coverage100% lines/98.86% branches; actual update/restart/coexistence/default-preservation receipts verify. - New single-commit hooks, online workflow security, signing and DCO pass. GitHub must rerun all required checks on this commit; results are not copied across SHAs. - Live repository setup validates18 Actions-bound checks, with only fuzzing added and all prior protections preserved. - OpenSSF project15417 is now owner-reviewed and saved at70% under owner-confirmed CDLA-Permissive2.0. This is an in-progress assessment, not a passing badge. - Production CI OIDC and signed1.0/dev publication remain required; local representative signing is not CI proof. Substantial AI assistance: Codex (GPT-6). Supersedes PR #3. Release work remains tracked in #33. Closes #4, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15, #16, #17, #18, #19, #20, #21, #22, #23, #24, #25, #26, #27, #28, #29, #32, #34. Refs #1, #5, #30, #31, #33.

github-advanced-security[bot] (Migrated from github.com) reviewed

2026-10-12 18:23:23 +00:00

.github/workflows/release.yml

						
				@@ -93,3 +98,4 @@

				    uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@93b1d6163a4c466ae443e98b62786fc4d80d33bd # v1.1.0

				    permissions:

				      contents: write      # create and publish the GitHub release

				      id-token: write      # sign attestations; Azure OIDC when signing

github-advanced-security[bot] (Migrated from github.com) commented

2026-10-12 18:23:23 +00:00

zizmor /

use GitHub's dedicated self-repository syntax: use '$/...' instead of './...'

Show more details

## zizmor / use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' [Show more details](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/security/code-scanning/12)

KofTwentyTwo commented

2026-10-12 18:23:54 +00:00

(Migrated from github.com)

Tool: Codex
Findings: resolved
Summary: The maintainer personally confirmed "PR 3 reviewed and approve" for baee14f. This replacement has the identical Git file tree a85912cbad, verified against that approved candidate; only commit-history/attribution metadata is changed. The owner-approved reader, release caller, documentation and screenshots are unchanged. GitHub verifies this single maintainer commit as valid. All required checks and production signing verification remain mandatory.

This record carries the actual owner approval of the identical file content from PR #3; it does not invent a new human code review or waive any checks. The original approval record is https://github.com/KofTwentyTwo/MarkdownViewr.Windows/pull/3#issuecomment-6129662138.
Maintainer acknowledgement: I read the review and resolved or answered every finding.

Tool: Codex Findings: resolved Summary: The maintainer personally confirmed "PR 3 reviewed and approve" for baee14f. This replacement has the identical Git file tree a85912cbad0330664cbddac32f8ca17973fd2c09, verified against that approved candidate; only commit-history/attribution metadata is changed. The owner-approved reader, release caller, documentation and screenshots are unchanged. GitHub verifies this single maintainer commit as valid. All required checks and production signing verification remain mandatory. This record carries the actual owner approval of the identical file content from PR #3; it does not invent a new human code review or waive any checks. The original approval record is https://github.com/KofTwentyTwo/MarkdownViewr.Windows/pull/3#issuecomment-6129662138. Maintainer acknowledgement: I read the review and resolved or answered every finding.

KofTwentyTwo (Migrated from github.com) reviewed

2026-10-12 19:01:36 +00:00

.github/workflows/release.yml

						
				@@ -93,3 +98,4 @@

				    uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@93b1d6163a4c466ae443e98b62786fc4d80d33bd # v1.1.0

				    permissions:

				      contents: write      # create and publish the GitHub release

				      id-token: write      # sign attestations; Azure OIDC when signing

KofTwentyTwo (Migrated from github.com) commented

2026-10-12 19:01:36 +00:00

This is the same tooling-compatibility recommendation assessed and resolved in the owner-reviewed PR #3, on the identical file tree: https://github.com/KofTwentyTwo/MarkdownViewr.Windows/pull/3#discussion_r4244908431.

GitHub continues to support ./ calls at the caller commit. The prior trial of all five $/ calls was rejected by the repository's pinned actionlint1.7.12 and was reverted without disabling any gate. Retain supported ./ until an approved validator update supports the recommended syntax. The external signing builder remains pinned to its full published SHA. Current workflow security and syntax checks pass; no exploitable application finding or signature-policy waiver is claimed.

Automated assessment by Codex; original owner approval and exact tree equality are documented in this PR.

This is the same tooling-compatibility recommendation assessed and resolved in the owner-reviewed PR #3, on the identical file tree: https://github.com/KofTwentyTwo/MarkdownViewr.Windows/pull/3#discussion_r4244908431. GitHub continues to support ./ calls at the caller commit. The prior trial of all five $/ calls was rejected by the repository's pinned actionlint1.7.12 and was reverted without disabling any gate. Retain supported ./ until an approved validator update supports the recommended syntax. The external signing builder remains pinned to its full published SHA. Current workflow security and syntax checks pass; no exploitable application finding or signature-policy waiver is claimed. Automated assessment by Codex; original owner approval and exact tree equality are documented in this PR.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/MarkdownViewr.Windows#35