chore(main): release 0.1.2 (#16)

First published immutable standards bundle containing policies, profiles, architectures, configs, workflows, templates, and tooling. Version and manifest are 0.1.2; changelog describes the complete snapshot and the corrected secret contract. v0.1.0 and v0.1.1 remain unpublished and reserved.

Release checklist: https://github.com/KofTwentyTwo/standards/issues/17

Validated package regression tests, Markdown lint, recorded AI review, and required PR gates. Substantial AI assistance: OpenAI GPT-6 Codex under maintainer authorization.

Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>

.github/workflows/ci.yml

@@ -125,7 +125,24 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
+      # Version files merge before publication; wait for the publisher's label.
+      - name: Check for unpublished merged releases
+        id: pending
+        env:
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          pending="$(gh api --paginate "repos/$GH_REPO/pulls?state=closed&per_page=100" --jq '.[] | select(.merged_at != null and any(.labels[]; .name == "autorelease: pending")) | .number')"
+          if [[ -n "$pending" ]]; then
+            echo 'can-propose=false' >> "$GITHUB_OUTPUT"
+            echo "Waiting for publication of merged release PR(s): $pending"
+          else
+            echo 'can-propose=true' >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Propose a semantic release
+        if: steps.pending.outputs.can-propose == 'true'
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           token: ${{ steps.app.outputs.token }}

.github/workflows/release-standards.yml

@@ -2,6 +2,10 @@ name: release-standards
 
 on:
   workflow_call:
+    secrets:
+      RELEASE_APP_PRIVATE_KEY:
+        description: App key resolved from the protected release environment.
+        required: true
 
 permissions: {}
 
@@ -51,11 +55,13 @@ jobs:
           }
           echo "pr=$pr" >> "$GITHUB_OUTPUT"
           # Preflight is approved before tagging; shipping checks follow publication.
-          checklist=''
+          annotation="$(git for-each-ref --format='%(contents)' "refs/tags/$TAG")"
+          checklist="$(printf '%s\n' "$annotation" | sed -n 's/^Release checklist: //p' | head -n 1)"
           if [[ "$version" == *.0 ]]; then
-            annotation="$(git for-each-ref --format='%(contents)' "refs/tags/$TAG")"
+            [[ -n "$checklist" ]]
+          fi
+          if [[ -n "$checklist" ]]; then
             prefix="https://github.com/$GH_REPO/issues/"
-            checklist="$(printf '%s\n' "$annotation" | grep -F 'Release checklist: ' | head -n 1 | sed 's/^Release checklist: //')"
             [[ "$checklist" == "$prefix"* ]]
             issue="${checklist#"$prefix"}"
             [[ "$issue" =~ ^[1-9][0-9]*$ ]]
@@ -70,6 +76,7 @@ jobs:
     uses: ./.github/workflows/ci.yml
     permissions:
       contents: read
+      pull-requests: read # required by ci.yml's nested PR caller even on tag events
       security-events: write
 
   build:

.github/workflows/release.yml

@@ -15,6 +15,9 @@ jobs:
   release:
     if: startsWith(github.ref, 'refs/tags/v')
     uses: ./.github/workflows/release-standards.yml
+    # Required even when the value exists only in the called job's environment.
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     permissions:
       contents: write
       issues: read

.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.1.0"}
+{".":"0.1.2"}

CHANGELOG.md

@@ -2,8 +2,31 @@
 
 <!-- Generated by Release Please; permit its section spacing. -->
 <!-- markdownlint-disable MD012 -->
+<!-- markdownlint-configure-file { "MD024": { "siblings_only": true } } -->
 
-## 0.1.0 (2026-10-10)
+## [0.1.2](https://github.com/KofTwentyTwo/standards/compare/v0.1.1...v0.1.2) (2026-10-10)
+
+First published standards bundle: policies, language profiles, architectures,
+configs, reusable workflows, templates, and tooling. The earlier `0.1.0` and
+`0.1.1` versions were never published; their signed tags remain reserved after
+the workflow failures documented below.
+
+
+### Bug Fixes
+
+* **releases:** declare the protected environment secret contract ([#15](https://github.com/KofTwentyTwo/standards/issues/15)) ([08b5ac8](https://github.com/KofTwentyTwo/standards/commit/08b5ac84a7b4d0a06d0b4c5f3ba9e643799084ad))
+
+## 0.1.1 (2026-10-10) — unpublished
+
+The bundle passed CI, checksums, and all five provenance checks, but publication
+stopped before draft creation because the reusable caller omitted its environment
+secret contract. This signed tag and the `0.1.0` baseline remain reserved.
+
+### Bug Fixes
+
+* **releases:** carry PR read permission through release gates ([#13](https://github.com/KofTwentyTwo/standards/issues/13)) ([e375cf3](https://github.com/KofTwentyTwo/standards/commit/e375cf3b07f6b209324fe9e0be77844bbd0397a2))
+
+## 0.1.0 (2026-10-10) — unpublished
 
 
 ### Features

docs/releases.md

@@ -46,7 +46,9 @@ version and notes before merging. A `breaking` label alone does not change the v
    `release` with a maintainer reviewer and deployment access for `v*` tags only.
    Store `RELEASE_APP_PRIVATE_KEY` separately in these **environment secrets**;
    never as a repository secret or committed file. Environments in the reusable
-   publisher resolve their own secrets; caller workflows do not pass the key.
+   publisher resolve their own secrets, but the caller must explicitly pass the
+   secret name and the reusable workflow must declare it. The named contract does
+   not expose the tag-only value to caller jobs or nested CI gates.
    Keep `protect-main` and `protect-release-tags` intact; the App does not create
    tags or bypass review. Allow the SHA-pinned Release Please action if repository
    action restrictions require an explicit allowlist entry.
@@ -71,16 +73,18 @@ and Release Please actions are pinned and tracked by Dependabot. See the
 
    ```bash
    git fetch origin main
-   git tag -s v0.1.0 <release-pr-merge-sha> \
+   git tag -s v0.1.2 <release-pr-merge-sha> \
      -m "Release checklist: https://github.com/KofTwentyTwo/standards/issues/123"
-   git push origin v0.1.0
+   git push origin v0.1.2
    ```
 
 4. The tag workflow validates ancestry, version files, the pending release PR, and
    the checklist; reruns all repository CI gates; builds and attests the assets;
    and waits for the `release` environment approval. Publication creates a draft with
    all assets and notes, then publishes it. The release PR is marked
-   `autorelease: tagged` so the next version can be proposed.
+   `autorelease: tagged` so the next version can be proposed. Version proposals wait
+   while a merged release PR has `autorelease: pending`; a failed, permanently
+   retired version uses `autorelease: failed` instead.
 
 These bundles ship no compiled software, so the compiled-artifact SBOM requirement
 does not apply. The included workflows/configs retain their upstream pins; source
@@ -93,10 +97,10 @@ Every release includes `KofTwentyTwo-standards-<version>.zip`, `.tar.gz`,
 and license split. Download assets from a specific version, then verify:
 
 ```bash
-gh release download v0.1.0 --repo KofTwentyTwo/standards --dir standards-0.1.0
-cd standards-0.1.0
+gh release download v0.1.2 --repo KofTwentyTwo/standards --dir standards-0.1.2
+cd standards-0.1.2
 sha256sum --check SHA256SUMS
-gh attestation verify KofTwentyTwo-standards-0.1.0.zip --repo KofTwentyTwo/standards
+gh attestation verify KofTwentyTwo-standards-0.1.2.zip --repo KofTwentyTwo/standards
 ```
 
 On Windows, compare `Get-FileHash -Algorithm SHA256` to the corresponding entry in
@@ -106,7 +110,7 @@ version comment; do not use a moving branch or tag as a workflow pin.
 To reproduce from a checkout containing the release commit:
 
 ```powershell
-pwsh tools/Build-StandardsPackage.ps1 -Version 0.1.0 -Ref v0.1.0 -OutputPath artifacts/rebuild-0.1.0
+pwsh tools/Build-StandardsPackage.ps1 -Version 0.1.2 -Ref v0.1.2 -OutputPath artifacts/rebuild-0.1.2
 pwsh tools/Test-StandardsPackage.ps1
 ```
 
@@ -116,6 +120,12 @@ same Git/archive tool versions. The builder refuses an existing output directory
 
 ## Failed releases
 
+The initial `v0.1.0` tag was reserved by a workflow-startup failure; no bundle was
+published for it. The `v0.1.1` publisher then stopped before draft creation because
+the caller omitted the environment secret contract. Both tags remain reserved;
+`v0.1.2` is the planned first published bundle. Keep these tags unchanged; use a new
+version when a tagged workflow needs a source fix.
+
 Never replace published assets or move/reuse a version tag. Fix a published error
 with a new release. A failed upload or publication leaves a draft; inspect its run
 and assets, then remove **only the unpublished draft** before rerunning the tag's

docs/security/threat-model.md

@@ -71,6 +71,12 @@ trust boundaries change.
 
 ## Review log
 
+- **2026-10-10, v0.1.2:** Reviewed the explicit reusable-workflow secret contract
+  after the unpublished v0.1.1 publisher failed. Only the named App key is passed;
+  its value remains restricted to the reviewer-protected tag environment. Nested
+  CI receives no secrets, and permissions, interfaces, and recovery boundaries
+  remain unchanged. Failed version tags stay reserved.
+
 - **2026-10-10, v0.1.0:** Reviewed source-only packaging, release-PR validation,
   preflight approval, App token scopes, environment restrictions, provenance, and
   immutable publication. Main and tag protections remain in place. Most likely

version.txt

@@ -1 +1 @@
-0.1.0
+0.1.2