KofTwentyTwo/standards
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

Release v0.1.1 #14

New Issue
Closed
opened 2026-10-10 14:24:00 +00:00 by KofTwentyTwo · 1 comment
KofTwentyTwo commented 2026-10-10 14:24:00 +00:00 (Migrated from github.com)
Copy link
Copy source

Release checklist: v0.1.1 First published immutable source-only standards bundle. Supersedes aborted v0.1.0 checklist #9; its signed tag remains reserved and no release assets were published. Based on templates/release-checklist.md (K22-REL-12); implementation and reviewed settings: #8. ## 1. Conformance - [x] Full Test-RepoConformance run has zero FAIL and zero UNKNOWN. Evidence below: 32 PASS, 3 WARN, 3 REVIEW, 1 N/A. - [x] Applicable exceptions EX-0001 and EX-0006 are Open and unexpired. EX-0006 is confined to the main-only version-bot key. - [x] Manual REVIEW rows checked: package/checker tests run on each PR and main push; CONTRIBUTING commands match CI; tagged publication reuses the same CI gates. ## 2. Scans and findings - [x] No open HIGH or CRITICAL code-scanning alerts on main. CodeQL, Trivy, workflow audits, and secret scanning pass. - [x] No open Dependabot alerts for shipped dependencies. - [x] No known shipped vulnerability needing OpenVEX. Scorecard process findings #1/#3/#4 are separately triaged with evidence and reassessment dates in docs/security/scorecard-dispositions.md. LOW #5 and MEDIUM #2 remain open recommendations. ## 3. Security assessment - [x] Threat model and review log updated for v0.1.1 in #8; distribution ADR reviewed. - [x] Changed interfaces: GitHub release API, scoped App installation tokens for version PRs/settings reads, tag-restricted publication, OIDC provenance, public archive downloads. - [x] Most likely failure: incomplete unpublished draft; retain the tag and inspect/recover the draft. Highest impact: compromised credentials/upstream Action; environment restrictions, repository-only installation, scoped tokens, SHA pins, protected PR gates, checksums, and immutable publication reduce reach. - [x] Live App identity, permissions, repository scope, secrets, and environments verified. App 5263433 (installation 169959557) is selected-repository only: KofTwentyTwo/standards; Contents/PR write, Administration read, Metadata read. Scoped settings-read token confirms immutability enabled. Keys are only in restricted environment secrets; main/tag protections have no new bypass. ## 4. Test depth - [x] Package regression tests cover committed-only ZIP/tar.gz content, hidden files, dirty/untracked exclusions, deterministic output, manifest commit, release-specific notes, checksum coverage, malformed versions, mismatches and refusal to overwrite. - [x] Mutation testing: N/A for this documentation/configuration bundle; no compiled core library is shipped. - [x] Fuzzing: no dedicated fuzz target is applicable to this initial source-only bundle; controlled Git/GitHub metadata has strict version validation and regression cases. The existing Scorecard fuzzing recommendation remains open. ## 5. Ship - [x] Main is green; version PR #10 is reviewed and merged at ad09505900 with correct 0.1.0 manifest/version and generated notes. Main CI 38058791109 and Scorecard passed; merge signature is Verified. - [x] All preflight checks above are complete; maintainer-authorized release: ready applied before tagging. - [ ] Signed tag v0.1.1 pushed to the release PR's merge commit; release workflow green. - [ ] ZIP/tar.gz, manifest, notes, and SHA256SUMS downloaded and verified; provenance verified for every asset; GitHub reports immutable=true. SBOM/platform executable signatures: N/A (no compiled artifacts). - [x] Official channel is GitHub Releases, linked from README; no winget/Homebrew/npm/NuGet publishing applies. ## Conformance evidence

KofTwentyTwo conformance: KofTwentyTwo/standards (full)

K22-REPO-01  MUST   PASS     LICENSE
K22-REPO-02  MUST   PASS     README.md has every required section
K22-REPO-03  MUST   PASS     .gitignore, .gitattributes (LF), .editorconfig present
K22-REPO-04  MUST   PASS     gitleaks: no findings in history; no open secret-scanning alerts
K22-REPO-05  MUST   PASS     no generated executables or archives tracked
K22-REPO-06  MUST   PASS     SECURITY.md
K22-REPO-07  MUST   PASS     CONTRIBUTING.md
K22-REPO-08  MUST   PASS     .github/CODEOWNERS has a default owner
K22-REPO-09  MUST   N/A      no package manifests found
K22-REPO-10  SHOULD WARN     no KofTwentyTwo/.github repository for shared community files
K22-REPO-11  SHOULD PASS     README shows the Scorecard badge
K22-REPO-20  MUST   PASS     protect-main complete (0 approval(s) for 1 maintainer(s))
K22-REPO-21  MUST   PASS     release tags immutable; only the maintainer creates them
K22-REPO-22  MUST   PASS     squash only, PR title/body, branches auto-deleted
K22-REPO-30  MUST   PASS     PVR, secret scanning + push protection, Dependabot alerts + updates, code scanning, immutable releases
K22-REPO-31  MUST   PASS     read-only token, no PR approvals by workflows, outside contributors need approval
K22-REPO-32  SHOULD WARN     allowed actions: all
K22-REPO-40  MUST   PASS     issues on, wiki off
K22-REPO-41  SHOULD WARN     no homepage
K22-REPO-42  MUST   PASS     listed in MAINTAINERS.md
K22-CI-01    MUST   PASS     requires 9 checks including every standard context
K22-CI-02    MUST   REVIEW   tests run on every PR and push: confirm in the language workflow
K22-CI-03    MUST   REVIEW   CI commands match CONTRIBUTING.md
K22-CI-10    MUST   PASS     10 workflow(s) start read-only
K22-CI-11    MUST   PASS     every action pinned to a commit SHA, every image to a digest
K22-CI-12    MUST   PASS     no untrusted expressions inside run: (zizmor in CI is authoritative)
K22-CI-13    MUST   PASS     no pull_request_target or workflow_run triggers
K22-CI-14    MUST   PASS     every checkout drops its credentials
K22-CI-15    MUST   PASS     release workflows use no caches
K22-CI-16    MUST   PASS     no repository-level secrets
K22-CI-17    MUST   PASS     GitHub-hosted runners only
K22-CI-18    SHOULD PASS     every job has a timeout
K22-CI-20    MUST   PASS     security.yml (secrets job)
K22-CI-21    MUST   PASS     SCA (CVEs and malicious packages) runs on changes and on a schedule
K22-CI-22    MUST   PASS     CodeQL security-extended
K22-CI-23    MUST   PASS     zizmor and actionlint run in CI
K22-CI-24    SHOULD PASS     Scorecard workflow present
K22-CI-30    MUST   PASS     releases through a SHA-pinned KofTwentyTwo/standards release-*.yml reusable workflow
K22-CI-31    MUST   REVIEW   the release workflow re-runs every main gate

N/A: 1  PASS: 32  REVIEW: 3  WARN: 3
# Release checklist: v0.1.1 First published immutable source-only standards bundle. Supersedes aborted v0.1.0 checklist #9; its signed tag remains reserved and no release assets were published. Based on templates/release-checklist.md (K22-REL-12); implementation and reviewed settings: #8. ## 1. Conformance - [x] Full Test-RepoConformance run has zero FAIL and zero UNKNOWN. Evidence below: 32 PASS, 3 WARN, 3 REVIEW, 1 N/A. - [x] Applicable exceptions EX-0001 and EX-0006 are Open and unexpired. EX-0006 is confined to the main-only version-bot key. - [x] Manual REVIEW rows checked: package/checker tests run on each PR and main push; CONTRIBUTING commands match CI; tagged publication reuses the same CI gates. ## 2. Scans and findings - [x] No open HIGH or CRITICAL code-scanning alerts on main. CodeQL, Trivy, workflow audits, and secret scanning pass. - [x] No open Dependabot alerts for shipped dependencies. - [x] No known shipped vulnerability needing OpenVEX. Scorecard process findings #1/#3/#4 are separately triaged with evidence and reassessment dates in docs/security/scorecard-dispositions.md. LOW #5 and MEDIUM #2 remain open recommendations. ## 3. Security assessment - [x] Threat model and review log updated for v0.1.1 in #8; distribution ADR reviewed. - [x] Changed interfaces: GitHub release API, scoped App installation tokens for version PRs/settings reads, tag-restricted publication, OIDC provenance, public archive downloads. - [x] Most likely failure: incomplete unpublished draft; retain the tag and inspect/recover the draft. Highest impact: compromised credentials/upstream Action; environment restrictions, repository-only installation, scoped tokens, SHA pins, protected PR gates, checksums, and immutable publication reduce reach. - [x] Live App identity, permissions, repository scope, secrets, and environments verified. App 5263433 (installation 169959557) is selected-repository only: KofTwentyTwo/standards; Contents/PR write, Administration read, Metadata read. Scoped settings-read token confirms immutability enabled. Keys are only in restricted environment secrets; main/tag protections have no new bypass. ## 4. Test depth - [x] Package regression tests cover committed-only ZIP/tar.gz content, hidden files, dirty/untracked exclusions, deterministic output, manifest commit, release-specific notes, checksum coverage, malformed versions, mismatches and refusal to overwrite. - [x] Mutation testing: N/A for this documentation/configuration bundle; no compiled core library is shipped. - [x] Fuzzing: no dedicated fuzz target is applicable to this initial source-only bundle; controlled Git/GitHub metadata has strict version validation and regression cases. The existing Scorecard fuzzing recommendation remains open. ## 5. Ship - [x] Main is green; version PR #10 is reviewed and merged at ad09505900cb9465b2a228bf984353861530f627 with correct 0.1.0 manifest/version and generated notes. Main CI 38058791109 and Scorecard passed; merge signature is Verified. - [x] All preflight checks above are complete; maintainer-authorized `release: ready` applied before tagging. - [ ] Signed tag v0.1.1 pushed to the release PR's merge commit; release workflow green. - [ ] ZIP/tar.gz, manifest, notes, and SHA256SUMS downloaded and verified; provenance verified for every asset; GitHub reports immutable=true. SBOM/platform executable signatures: N/A (no compiled artifacts). - [x] Official channel is GitHub Releases, linked from README; no winget/Homebrew/npm/NuGet publishing applies. ## Conformance evidence ```text KofTwentyTwo conformance: KofTwentyTwo/standards (full) K22-REPO-01 MUST PASS LICENSE K22-REPO-02 MUST PASS README.md has every required section K22-REPO-03 MUST PASS .gitignore, .gitattributes (LF), .editorconfig present K22-REPO-04 MUST PASS gitleaks: no findings in history; no open secret-scanning alerts K22-REPO-05 MUST PASS no generated executables or archives tracked K22-REPO-06 MUST PASS SECURITY.md K22-REPO-07 MUST PASS CONTRIBUTING.md K22-REPO-08 MUST PASS .github/CODEOWNERS has a default owner K22-REPO-09 MUST N/A no package manifests found K22-REPO-10 SHOULD WARN no KofTwentyTwo/.github repository for shared community files K22-REPO-11 SHOULD PASS README shows the Scorecard badge K22-REPO-20 MUST PASS protect-main complete (0 approval(s) for 1 maintainer(s)) K22-REPO-21 MUST PASS release tags immutable; only the maintainer creates them K22-REPO-22 MUST PASS squash only, PR title/body, branches auto-deleted K22-REPO-30 MUST PASS PVR, secret scanning + push protection, Dependabot alerts + updates, code scanning, immutable releases K22-REPO-31 MUST PASS read-only token, no PR approvals by workflows, outside contributors need approval K22-REPO-32 SHOULD WARN allowed actions: all K22-REPO-40 MUST PASS issues on, wiki off K22-REPO-41 SHOULD WARN no homepage K22-REPO-42 MUST PASS listed in MAINTAINERS.md K22-CI-01 MUST PASS requires 9 checks including every standard context K22-CI-02 MUST REVIEW tests run on every PR and push: confirm in the language workflow K22-CI-03 MUST REVIEW CI commands match CONTRIBUTING.md K22-CI-10 MUST PASS 10 workflow(s) start read-only K22-CI-11 MUST PASS every action pinned to a commit SHA, every image to a digest K22-CI-12 MUST PASS no untrusted expressions inside run: (zizmor in CI is authoritative) K22-CI-13 MUST PASS no pull_request_target or workflow_run triggers K22-CI-14 MUST PASS every checkout drops its credentials K22-CI-15 MUST PASS release workflows use no caches K22-CI-16 MUST PASS no repository-level secrets K22-CI-17 MUST PASS GitHub-hosted runners only K22-CI-18 SHOULD PASS every job has a timeout K22-CI-20 MUST PASS security.yml (secrets job) K22-CI-21 MUST PASS SCA (CVEs and malicious packages) runs on changes and on a schedule K22-CI-22 MUST PASS CodeQL security-extended K22-CI-23 MUST PASS zizmor and actionlint run in CI K22-CI-24 SHOULD PASS Scorecard workflow present K22-CI-30 MUST PASS releases through a SHA-pinned KofTwentyTwo/standards release-*.yml reusable workflow K22-CI-31 MUST REVIEW the release workflow re-runs every main gate N/A: 1 PASS: 32 REVIEW: 3 WARN: 3 ```
KofTwentyTwo commented 2026-10-10 14:40:59 +00:00 (Migrated from github.com)
Copy link
Copy source

Aborted before draft creation: tag run https://github.com/KofTwentyTwo/standards/actions/runs/38059928147 passed every gate, built the bundle, and all five assets passed checksum/provenance verification. Publication then failed because the reusable caller omitted its environment secret contract. No GitHub release or assets were published. Keep v0.1.1 unchanged and reserve the version; a corrected source version needs a new signed tag and checklist.

Aborted before draft creation: tag run https://github.com/KofTwentyTwo/standards/actions/runs/38059928147 passed every gate, built the bundle, and all five assets passed checksum/provenance verification. Publication then failed because the reusable caller omitted its environment secret contract. No GitHub release or assets were published. Keep v0.1.1 unchanged and reserve the version; a corrected source version needs a new signed tag and checklist.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 autorelease: failed
Reserved version tag; no published release
 autorelease: pending
autorelease: tagged
breaking
Incompatible new mandatory standards; requires a MAJOR release
 bug
Something isn't working
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 release: failed
Reserved release tag failed before public publication; preserved for audit.
 release: ready
Maintainer-approved release preflight
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#14