KofTwentyTwo/gclo
2
0 Fork 0
Code Issues 28 Pull Requests 1 Actions Packages Projects Releases 22 Wiki Activity

Release v1.0.1 #67

New Issue
Closed
opened 2026-10-09 14:53:56 +00:00 by KofTwentyTwo · 14 comments
KofTwentyTwo commented 2026-10-09 14:53:56 +00:00 (Migrated from github.com)
Copy link
Copy source

1. Conformance (K22-SDLC-33)

  • tools/Test-RepoConformance.ps1 -Repository KofTwentyTwo/gclo has no FAIL (EXCEPTED is fine). Output attached below.
  • Exceptions this repository relies on are open and unexpired.

2. Scans and findings (K22-SEC-41, K22-SEC-42)

  • No open code-scanning alerts at HIGH or CRITICAL on main.
  • No open Dependabot alerts at HIGH or CRITICAL for shipped dependencies.
  • Every known-but-not-exploitable finding has an OpenVEX statement in docs/security/vex.json with a justification (none expected).

5. Ship

  • main is green; release notes reviewed (breaking changes and security fixes first).
  • Tag v1.0.1 pushed; release workflow green.
  • Release assets verified: SHA256SUMS, attestations (gh attestation verify), SBOM present (platform signature: EX-0002).
  • Announcements and channel updates done (Scoop manifest PR merged; Chocolatey/winget when their secrets exist).
Conformance output 
paste here
<!-- K22-REL-12. PATCH release: sections 1, 2 and 5 only. --> ## 1. Conformance (K22-SDLC-33) - [ ] `tools/Test-RepoConformance.ps1 -Repository KofTwentyTwo/gclo` has no FAIL (EXCEPTED is fine). Output attached below. - [ ] Exceptions this repository relies on are open and unexpired. ## 2. Scans and findings (K22-SEC-41, K22-SEC-42) - [ ] No open code-scanning alerts at HIGH or CRITICAL on `main`. - [ ] No open Dependabot alerts at HIGH or CRITICAL for shipped dependencies. - [ ] Every known-but-not-exploitable finding has an OpenVEX statement in `docs/security/vex.json` with a justification (none expected). ## 5. Ship - [ ] `main` is green; release notes reviewed (breaking changes and security fixes first). - [ ] Tag `v1.0.1` pushed; release workflow green. - [ ] Release assets verified: `SHA256SUMS`, attestations (`gh attestation verify`), SBOM present (platform signature: EX-0002). - [ ] Announcements and channel updates done (Scoop manifest PR merged; Chocolatey/winget when their secrets exist). <details><summary>Conformance output</summary> ```text paste here ``` </details>
KofTwentyTwo commented 2026-10-09 19:48:41 +00:00 (Migrated from github.com)
Copy link
Copy source

Conformance run against main at 50b3c13 (after #68–#70, settings and rulesets applied), 2026-10-09:
  • K22-CI-30 FAIL is covered by standards EX-0004 until the shared Velopack release workflow ships (the standards session is landing it; gclo will re-pin and replace release.yml then).
  • REPO-10 / REPO-32 WARN are SHOULD-level and tracked on #66 (org .github repo, allowed-actions policy).
  • The three REVIEW items are manual confirmations: CI runs tests on every PR and push (ci.yml), CONTRIBUTING lists the same commands, and the release workflow re-runs build/test/format before publishing.

Still open before tagging: merge #71 and #73, delete dev (both refused to the agent).

Conformance run against `main` at `50b3c13` (after #68–#70, settings and rulesets applied), 2026-10-09: ```text ``` - **K22-CI-30 FAIL** is covered by standards EX-0004 until the shared Velopack release workflow ships (the standards session is landing it; gclo will re-pin and replace `release.yml` then). - **REPO-10 / REPO-32 WARN** are SHOULD-level and tracked on #66 (org `.github` repo, allowed-actions policy). - The three REVIEW items are manual confirmations: CI runs tests on every PR and push (`ci.yml`), CONTRIBUTING lists the same commands, and the release workflow re-runs build/test/format before publishing. Still open before tagging: merge #71 and #73, delete `dev` (both refused to the agent).
KofTwentyTwo commented 2026-10-09 21:54:35 +00:00 (Migrated from github.com)
Copy link
Copy source

Hold on v1.0.1 (maintainer decision, 2026-10-09): the stable tag is not pushed until (1) the release path works 100% with real publishes: CHOCO_API_KEY, WINGET_TOKEN (and NuGet if used) in a release environment, and release.yml changed so a missing secret fails instead of skipping; (2) the shared Velopack release workflow (standards main e8ab30f) is adopted and proven on a prerelease tag (v1.0.1-beta.2), closing EX-0004; (3) the candidate build is installed and verified by hand (clean install, Quick Sync, self-update from v1.0.1-beta.1) and signed off here. All standards work is on main (#68, #69, #70, #71, #73 merged; dev retired). #75 (docs) still open.

**Hold on `v1.0.1` (maintainer decision, 2026-10-09):** the stable tag is not pushed until (1) the release path works 100% with real publishes: `CHOCO_API_KEY`, `WINGET_TOKEN` (and NuGet if used) in a `release` environment, and `release.yml` changed so a missing secret **fails** instead of skipping; (2) the shared Velopack release workflow (standards main `e8ab30f`) is adopted and proven on a prerelease tag (`v1.0.1-beta.2`), closing EX-0004; (3) the candidate build is installed and verified by hand (clean install, Quick Sync, self-update from v1.0.1-beta.1) and signed off here. All standards work is on `main` (#68, #69, #70, #71, #73 merged; `dev` retired). #75 (docs) still open.
KofTwentyTwo commented 2026-10-09 22:56:25 +00:00 (Migrated from github.com)
Copy link
Copy source

Release-path work for the hold: #77 replaces the in-repo build with the standards' shared Velopack workflow (e8ab30f) and makes every publisher fail on a missing token. It also fixes a latent bug: the locked release publish added in #68 had never run and was rejected by locked mode (RID graph + ILLink.Tasks); the lock files and project files now carry both graphs and the exact publish commands pass locally. The release environment exists (tags v*). Before the v1.0.1-beta.2 rehearsal: add the tokens listed on #7 to that environment (prerelease needs none of them, so the rehearsal can run first).

Release-path work for the hold: **#77** replaces the in-repo build with the standards' shared Velopack workflow (`e8ab30f`) and makes every publisher fail on a missing token. It also fixes a latent bug: the locked release publish added in #68 had never run and was rejected by locked mode (RID graph + ILLink.Tasks); the lock files and project files now carry both graphs and the exact publish commands pass locally. The `release` environment exists (tags `v*`). Before the `v1.0.1-beta.2` rehearsal: add the tokens listed on #7 to that environment (prerelease needs none of them, so the rehearsal can run first).
KofTwentyTwo commented 2026-10-10 12:59:28 +00:00 (Migrated from github.com)
Copy link
Copy source

Rehearsal v1.0.1-beta.2 (run 38053540124): Verify tag ✅, Gates (build-test, format, ui-tests) ✅, Release / build ❌ in the shared workflow's Release build: NETSDK1094, the ReadyToRun pack is not restored on a clean runner because gclo.csproj enables PublishReadyToRun for every non-Debug build (see the new issue). Nothing was published (no draft, no assets), so the tag is spent and the next rehearsal will be v1.0.1-beta.3 once the fix is merged.

**Rehearsal `v1.0.1-beta.2`** (run [38053540124](https://github.com/KofTwentyTwo/gclo/actions/runs/38053540124)): Verify tag ✅, Gates (build-test, format, ui-tests) ✅, **Release / build ❌** in the shared workflow's Release build: NETSDK1094, the ReadyToRun pack is not restored on a clean runner because `gclo.csproj` enables `PublishReadyToRun` for every non-Debug build (see the new issue). Nothing was published (no draft, no assets), so the tag is spent and the next rehearsal will be `v1.0.1-beta.3` once the fix is merged.
KofTwentyTwo commented 2026-10-10 13:19:06 +00:00 (Migrated from github.com)
Copy link
Copy source

Rehearsal v1.0.1-beta.3 succeeded end to end (run 38054480791) after #79 fixed the clean-runner ReadyToRun restore: Verify tag, all three gates, and the shared workflow's build / package / sbom / attest / release jobs all green; the stable-only publishers were skipped as designed for a prerelease.

Release v1.0.1-beta.3 (dev channel) carries: gclo-dev-Setup.exe, gclo-dev-Portable.zip, gclo-1.0.1-beta.3-dev-full.nupkg, gclo-1.0.1-beta.3-dev-delta.nupkg (delta against beta.1 worked), releases.dev.json, gclo-cli-win-x64-1.0.1-beta.3.zip, both SBOMs, SHA256SUMS.

Verified locally from a fresh download: sha256sum --check OK for every downloaded asset; gh attestation verify <asset> --repo KofTwentyTwo/gclo --signer-repo KofTwentyTwo/standards passes with an SLSA v1 provenance for the Setup exe, the CLI zip and SHA256SUMS; the CycloneDX SBOM attestation verifies on the CLI zip.

Manual verification (maintainer): install gclo-dev-Setup.exe on a clean machine, run a Quick Sync, let the installed v1.0.1-beta.1 self-update to beta.3, then tick the sign-off here. After that: v1.0.1.

**Rehearsal `v1.0.1-beta.3` succeeded end to end** (run [38054480791](https://github.com/KofTwentyTwo/gclo/actions/runs/38054480791)) after #79 fixed the clean-runner ReadyToRun restore: Verify tag, all three gates, and the shared workflow's build / package / sbom / attest / release jobs all green; the stable-only publishers were skipped as designed for a prerelease. Release [v1.0.1-beta.3](https://github.com/KofTwentyTwo/gclo/releases/tag/v1.0.1-beta.3) (dev channel) carries: `gclo-dev-Setup.exe`, `gclo-dev-Portable.zip`, `gclo-1.0.1-beta.3-dev-full.nupkg`, `gclo-1.0.1-beta.3-dev-delta.nupkg` (delta against beta.1 worked), `releases.dev.json`, `gclo-cli-win-x64-1.0.1-beta.3.zip`, both SBOMs, `SHA256SUMS`. Verified locally from a fresh download: `sha256sum --check` OK for every downloaded asset; `gh attestation verify <asset> --repo KofTwentyTwo/gclo --signer-repo KofTwentyTwo/standards` passes with an SLSA v1 provenance for the Setup exe, the CLI zip and SHA256SUMS; the CycloneDX SBOM attestation verifies on the CLI zip. **Manual verification (maintainer):** install `gclo-dev-Setup.exe` on a clean machine, run a Quick Sync, let the installed v1.0.1-beta.1 self-update to beta.3, then tick the sign-off here. After that: `v1.0.1`.
KofTwentyTwo commented 2026-10-10 13:19:14 +00:00 (Migrated from github.com)
Copy link
Copy source

Conformance on main at 3f05d54 (after #77 and #79), 2026-10-10: zero FAIL — 34 PASS, 3 REVIEW (manual confirmations, all hold), 2 SHOULD-level WARN (org .github repo, allowed-actions policy; tracked on #66). K22-CI-30 now passes.
Conformance on `main` at `3f05d54` (after #77 and #79), 2026-10-10: **zero FAIL** — 34 PASS, 3 REVIEW (manual confirmations, all hold), 2 SHOULD-level WARN (org `.github` repo, allowed-actions policy; tracked on #66). K22-CI-30 now passes. ```text ```
KofTwentyTwo commented 2026-10-10 15:00:56 +00:00 (Migrated from github.com)
Copy link
Copy source

v1.0.1 shipped (run 38060894728)

  • Tag v1.0.1 pushed on main at 3f05d54 after the user's go. Jobs: verify ✅, gates (build-test, format, ui-tests) ✅, release (build, package, sbom, attest, release) ✅, Scoop and Chocolatey ✅; winget and NuGet skipped by design (not opted in).
  • Release https://github.com/KofTwentyTwo/gclo/releases/tag/v1.0.1 (stable, not draft): gclo-stable-Setup.exe, gclo-stable-Portable.zip, gclo-1.0.1-stable-full.nupkg, gclo-1.0.1-stable-delta.nupkg (delta from 1.0.0), releases.stable.json, gclo-cli-win-x64-1.0.1.zip, gclo-1.0.1.cdx.json, gclo-cli-1.0.1.cdx.json, SHA256SUMS.
  • sha256sum -c SHA256SUMS: 8/8 OK. gh attestation verify … --repo KofTwentyTwo/gclo --signer-repo KofTwentyTwo/standards passes for the Setup, CLI zip and full nupkg (SLSA provenance) and for the CycloneDX SBOM predicate.
  • gclo.1.0.1.nupkg pushed to chocolatey.org; it is in the moderation queue (first version).
  • Packaging PR #80 opened but pr / dco fails: the generated commit has no sign-off. Permanent fix: #81 / PR #82. #80 needs its commit amended with git commit --amend -s (or an admin merge).

Open: watch a stable 1.0.0 install self-update to 1.0.1 (first stable update through the new pipeline); winget bootstrap (wingetcreate new on the stable Setup URL, then WINGET_PACKAGE_ID + WINGET_TOKEN).

## v1.0.1 shipped (run 38060894728) - Tag `v1.0.1` pushed on `main` at 3f05d54 after the user's go. Jobs: verify ✅, gates (build-test, format, ui-tests) ✅, release (build, package, sbom, attest, release) ✅, Scoop and Chocolatey ✅; winget and NuGet skipped by design (not opted in). - Release https://github.com/KofTwentyTwo/gclo/releases/tag/v1.0.1 (stable, not draft): `gclo-stable-Setup.exe`, `gclo-stable-Portable.zip`, `gclo-1.0.1-stable-full.nupkg`, `gclo-1.0.1-stable-delta.nupkg` (delta from 1.0.0), `releases.stable.json`, `gclo-cli-win-x64-1.0.1.zip`, `gclo-1.0.1.cdx.json`, `gclo-cli-1.0.1.cdx.json`, `SHA256SUMS`. - `sha256sum -c SHA256SUMS`: 8/8 OK. `gh attestation verify … --repo KofTwentyTwo/gclo --signer-repo KofTwentyTwo/standards` passes for the Setup, CLI zip and full nupkg (SLSA provenance) and for the CycloneDX SBOM predicate. - `gclo.1.0.1.nupkg` pushed to chocolatey.org; it is in the moderation queue (first version). - Packaging PR #80 opened but **`pr / dco` fails**: the generated commit has no sign-off. Permanent fix: #81 / PR #82. #80 needs its commit amended with `git commit --amend -s` (or an admin merge). Open: watch a stable 1.0.0 install self-update to 1.0.1 (first stable update through the new pipeline); winget bootstrap (`wingetcreate new` on the stable Setup URL, then `WINGET_PACKAGE_ID` + `WINGET_TOKEN`).
KofTwentyTwo commented 2026-10-10 17:49:31 +00:00 (Migrated from github.com)
Copy link
Copy source

v1.0.1 is broken: it crashes at startup (#87). The published gclo.pri lacks the WinUI theme resources because the shared workflow's Release build and self-contained publish share one obj and the incremental PRI target skipped. Beta.3 had the same defect; the rehearsal was never installed before the stable tag. Done: 1.0.1 marked prerelease with a warning (runbook), 1.0.0 reinstalled on the maintainer machine, fix + smoke gate in PR #88, standards#22 filed. Plan: merge #88, tag v1.0.2-beta.1, install it on a clean machine and update from 1.0.0, then tag v1.0.2 (also the first run of the App-token packaging PR).

**v1.0.1 is broken: it crashes at startup (#87).** The published gclo.pri lacks the WinUI theme resources because the shared workflow's Release build and self-contained publish share one obj and the incremental PRI target skipped. Beta.3 had the same defect; the rehearsal was never installed before the stable tag. Done: 1.0.1 marked prerelease with a warning (runbook), 1.0.0 reinstalled on the maintainer machine, fix + smoke gate in PR #88, standards#22 filed. Plan: merge #88, tag v1.0.2-beta.1, **install it on a clean machine and update from 1.0.0**, then tag v1.0.2 (also the first run of the App-token packaging PR).
KofTwentyTwo commented 2026-10-10 18:40:51 +00:00 (Migrated from github.com)
Copy link
Copy source

v1.0.2-beta.1 (run 38074357696): smoke gate green, published build verified to launch (gclo.pri 2,298,032 B). Installed over the local 1.0.0 to rehearse: the app opens and Quick Sync lists organizations, but the Setup wiped accounts.json/settings.json (#91, data root inside the Velopack install root). #91 is a release blocker for v1.0.2: without it any reinstall or channel switch destroys user data. Format gate flaked once (PSScriptAnalyzer, #89 → PR #90).

v1.0.2-beta.1 (run 38074357696): smoke gate green, published build verified to launch (gclo.pri 2,298,032 B). Installed over the local 1.0.0 to rehearse: the app opens and Quick Sync lists organizations, **but the Setup wiped accounts.json/settings.json (#91, data root inside the Velopack install root)**. #91 is a release blocker for v1.0.2: without it any reinstall or channel switch destroys user data. Format gate flaked once (PSScriptAnalyzer, #89 → PR #90).
KofTwentyTwo commented 2026-10-10 19:58:05 +00:00 (Migrated from github.com)
Copy link
Copy source

v1.0.2-beta.2 (run 38080813985): gates + smoke green, Azure OIDC login OK, first CI signing started but the shared workflow signs all ~285 exe/dll under publish and hit the action's 300 s default timeout after 149 files. Nothing published; the tag is spent, next rehearsal is v1.0.2-beta.3 after the shared workflow signs only unsigned binaries (standards issue filed) and gclo re-pins.

v1.0.2-beta.2 (run 38080813985): gates + smoke green, Azure OIDC login OK, first CI signing started but the shared workflow signs all ~285 exe/dll under publish and hit the action's 300 s default timeout after 149 files. Nothing published; the tag is spent, next rehearsal is v1.0.2-beta.3 after the shared workflow signs only unsigned binaries (standards issue filed) and gclo re-pins.
KofTwentyTwo commented 2026-10-10 21:33:35 +00:00 (Migrated from github.com)
Copy link
Copy source

v1.0.2-beta.3 (run 38087007507): first CI-signed build, fully verified

  • verify → gates → smoke → release (build, package with signing + pre-draft signtool verify, sbom, attest, release) all green. Publishers skipped (prerelease).
  • Downloaded assets verified locally: SHA256SUMS 8/8; signtool verify /pa /all on Setup.exe and all 289 exe/dll inside the portable and CLI zips: 0 failures; Setup.exe, Update.exe, gclo.exe (app and CLI) Valid, CN=James Maes, timestamped; 51 files signed by us, the rest keep their Microsoft signatures; provenance attestation verifies with --signer-repo KofTwentyTwo/standards.
  • Installed gclo-dev-Setup.exe on the maintainer machine: opens, Quick Sync lists 12 organizations, data now under %LOCALAPPDATA%\KofTwentyTwo\gclo (#91), update check reports current.
  • One defect in the caller-side verify-signatures job: it did not run in the release environment and read an empty TRUSTED_SIGNING_SUBJECT → PR #100. The release itself is correct.

Next: merge #100, then v1.0.2 (stable; runs the App-token packaging PR and the signed stable channel for the first time), watch the 1.0.0 → 1.0.2 update on this machine, then close EX-0002 in the standards register and this checklist.

## v1.0.2-beta.3 (run 38087007507): first CI-signed build, fully verified - verify → gates → smoke → release (build, **package with signing + pre-draft `signtool verify`**, sbom, attest, release) all green. Publishers skipped (prerelease). - Downloaded assets verified locally: `SHA256SUMS` 8/8; `signtool verify /pa /all` on Setup.exe and **all 289 exe/dll** inside the portable and CLI zips: 0 failures; Setup.exe, Update.exe, gclo.exe (app and CLI) `Valid`, `CN=James Maes`, timestamped; 51 files signed by us, the rest keep their Microsoft signatures; provenance attestation verifies with `--signer-repo KofTwentyTwo/standards`. - Installed `gclo-dev-Setup.exe` on the maintainer machine: opens, Quick Sync lists 12 organizations, data now under `%LOCALAPPDATA%\KofTwentyTwo\gclo` (#91), update check reports current. - One defect in the caller-side `verify-signatures` job: it did not run in the `release` environment and read an empty `TRUSTED_SIGNING_SUBJECT` → PR #100. The release itself is correct. Next: merge #100, then `v1.0.2` (stable; runs the App-token packaging PR and the signed stable channel for the first time), watch the 1.0.0 → 1.0.2 update on this machine, then close EX-0002 in the standards register and this checklist.
KofTwentyTwo commented 2026-10-11 00:05:11 +00:00 (Migrated from github.com)
Copy link
Copy source

v1.1.0-beta.1 (run 38096239047): dev edition, signed, verified, installed beside the old install

  • All pipeline jobs green (verify, gates, smoke, build, package with signing, sbom, attest, release). Only the caller-side verify-signatures job failed: it looked for gclo-cli-win-x64-…zip while the dev edition ships gclo-dev-cli-win-x64-…zip (fix PR open).
  • Verified locally: SHA256SUMS 8/8; signtool verify /pa /all on Setup.exe and all 289 exe/dll in the portable and CLI zips: 0 failures (51 ours, the rest Microsoft); provenance attestation verifies.
  • Installed gclo-dev-dev-Setup.exe on the maintainer machine: it lives in %LOCALAPPDATA%\gclo-dev beside the existing gclo install, title "gclo (dev)", own data root %LOCALAPPDATA%\KofTwentyTwo\gclo-dev, Start menu entries for both, stable data untouched, Quick Sync lists organizations with the shared default token, update check reports current on its channel.
  • Contents: default-token accounts (#101, #102), Help links (#108), dev edition (#114), plus the 1.0.1 crash fix, data-root move and signing from the earlier betas.

Next: owner green light → v1.1.0 (stable, app id gclo), which exercises the App-token packaging PR and Chocolatey for the first time since signing; then close EX-0002 and this checklist.

## v1.1.0-beta.1 (run 38096239047): dev edition, signed, verified, installed beside the old install - All pipeline jobs green (verify, gates, smoke, build, package with signing, sbom, attest, release). Only the caller-side `verify-signatures` job failed: it looked for `gclo-cli-win-x64-…zip` while the dev edition ships `gclo-dev-cli-win-x64-…zip` (fix PR open). - Verified locally: `SHA256SUMS` 8/8; `signtool verify /pa /all` on Setup.exe and all 289 exe/dll in the portable and CLI zips: 0 failures (51 ours, the rest Microsoft); provenance attestation verifies. - Installed `gclo-dev-dev-Setup.exe` on the maintainer machine: it lives in `%LOCALAPPDATA%\gclo-dev` beside the existing `gclo` install, title "gclo (dev)", own data root `%LOCALAPPDATA%\KofTwentyTwo\gclo-dev`, Start menu entries for both, stable data untouched, Quick Sync lists organizations with the shared default token, update check reports current on its channel. - Contents: default-token accounts (#101, #102), Help links (#108), dev edition (#114), plus the 1.0.1 crash fix, data-root move and signing from the earlier betas. Next: owner green light → `v1.1.0` (stable, app id `gclo`), which exercises the App-token packaging PR and Chocolatey for the first time since signing; then close EX-0002 and this checklist.
KofTwentyTwo commented 2026-10-11 12:30:09 +00:00 (Migrated from github.com)
Copy link
Copy source

v1.1.0 shipped (run 38138151291) — first signed stable release

  • Pipeline: verify, gates, smoke, signed package (pre-draft signtool verify), SBOMs, attestations, release, verify-signatures ✅. Publishers: Scoop/Chocolatey job failed at the Chocolatey push (HTTP 403: the 1.0.1 package is still in chocolatey.org's moderation queue, one version at a time) before it could open the manifests PR → opened by hand as #123; the push is re-run when moderation clears (#129 makes the PR independent of the push). winget and NuGet skipped by design.
  • Verified locally: SHA256SUMS 8/8; signtool verify /pa /all on Setup.exe and all 289 exe/dll in the portable and CLI zips, 0 failures; provenance attestation verifies with --signer-repo KofTwentyTwo/standards.
  • Stable self-update exercised for real: a clean 1.0.0 install on the maintainer machine took Help → Check for updates and restarted as 1.1.0, data under %LOCALAPPDATA%\KofTwentyTwo\gclo. The dev edition (v1.1.0-beta.1, gclo-dev) stays installed beside it.
  • 1.0.1 notes now point at 1.1.0. EX-0002 closed for gclo (standards#33).

Remaining owner items: winget bootstrap (wingetcreate new on the v1.1.0 gclo-stable-Setup.exe, then WINGET_PACKAGE_ID + WINGET_TOKEN); re-run the packages job once Chocolatey moderation clears; org-level SHOULDs on #66.

## v1.1.0 shipped (run 38138151291) — first signed stable release - Pipeline: verify, gates, smoke, signed package (pre-draft `signtool verify`), SBOMs, attestations, release, **verify-signatures ✅**. Publishers: Scoop/Chocolatey job failed at the Chocolatey push (HTTP 403: the 1.0.1 package is still in chocolatey.org's moderation queue, one version at a time) before it could open the manifests PR → opened by hand as #123; the push is re-run when moderation clears (#129 makes the PR independent of the push). winget and NuGet skipped by design. - Verified locally: `SHA256SUMS` 8/8; `signtool verify /pa /all` on Setup.exe and all 289 exe/dll in the portable and CLI zips, 0 failures; provenance attestation verifies with `--signer-repo KofTwentyTwo/standards`. - **Stable self-update exercised for real:** a clean 1.0.0 install on the maintainer machine took Help → Check for updates and restarted as 1.1.0, data under `%LOCALAPPDATA%\KofTwentyTwo\gclo`. The dev edition (v1.1.0-beta.1, `gclo-dev`) stays installed beside it. - 1.0.1 notes now point at 1.1.0. EX-0002 closed for gclo (standards#33). Remaining owner items: winget bootstrap (`wingetcreate new` on the v1.1.0 `gclo-stable-Setup.exe`, then `WINGET_PACKAGE_ID` + `WINGET_TOKEN`); re-run the packages job once Chocolatey moderation clears; org-level SHOULDs on #66.
KofTwentyTwo commented 2026-10-11 12:30:10 +00:00 (Migrated from github.com)
Copy link
Copy source

Released as v1.1.0 (the standards work shipped in v1.0.2-beta.3 → v1.1.0). Follow-ups tracked on #66 (org-level SHOULDs), #129 (packaging job), #7 (winget bootstrap).

Released as v1.1.0 (the standards work shipped in v1.0.2-beta.3 → v1.1.0). Follow-ups tracked on #66 (org-level SHOULDs), #129 (packaging job), #7 (winget bootstrap).
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
.NET
Pull requests that update .NET code
 bug
Something isn't working
 deferred
Agreed follow-up, not scheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on an action only the owner can take
 priority
Owner-flagged: work this first
 quality
Standards, simplicity, enforcement
 question
Further information is requested
 refactor
Restructuring without behavior change
 release
Release pipeline / distribution
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#67