KofTwentyTwo/standards
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

Release v0.1.2 #17

New Issue
Closed
opened 2026-10-10 14:45:09 +00:00 by KofTwentyTwo · 1 comment
KofTwentyTwo commented 2026-10-10 14:45:09 +00:00 (Migrated from github.com)
Copy link
Copy source

Release checklist: v0.1.2

First published immutable standards bundle, based on templates/release-checklist.md. The unpublished v0.1.0 and v0.1.1 tags remain reserved; closed checklists #9 and #14 record those failures. Implementation: #8; publisher corrections: #13 and #15; version proposal: #16.

1. Conformance

  • Full Test-RepoConformance.ps1 -Repository KofTwentyTwo/standards -LocalPath . reports zero FAIL and UNKNOWN: 32 PASS, 3 existing WARN, 3 REVIEW, 1 N/A. Full output below.
  • EX-0001 and EX-0006 are Open and unexpired. The main-only bot key uses EX-0006; unrelated EX-0005 is preserved.
  • Manual REVIEW rows checked: checker/package tests run on PRs and main; CONTRIBUTING commands match CI; the release reuses all main gates.

2. Scans and findings

  • No open HIGH/CRITICAL code-scanning alerts on main. Required CodeQL, Trivy, workflow, secret, and dependency checks pass.
  • No open Dependabot alerts for shipped dependencies.
  • No known shipped vulnerability requiring OpenVEX. Scorecard process alerts #1/#3/#4 have dated dispositions in docs/security/scorecard-dispositions.md; LOW #5 and MEDIUM #2 remain open follow-ups.

3. Security assessment

  • Distribution ADR and threat model reviewed, including the v0.1.2 review log and explicit reusable secret contract.
  • Interfaces: scoped GitHub App tokens, GitHub release API, tag-only protected publication, OIDC provenance, and public archive downloads. No new interface in the corrections.
  • Most likely failure: unpublished workflow/draft interruption; retain each tag, use a new version for source fixes, and inspect drafts before recovery. Highest impact: compromised credential/upstream Action; scoped installation/tokens, restricted environments, reviewed SHA pins, required gates, and immutable publication limit reach.
  • App 5263433 and installation 169959557 verified: selected repository KofTwentyTwo/standards only; Contents/PR write, Administration/Metadata read. Secrets remain environment-only. Main/tag protections and release reviewer remain intact; immutability is enabled.

4. Test depth

  • Regression tests cover committed-only ZIP/tar.gz content, hidden files, dirty/untracked exclusion, deterministic output, manifest source, release-specific notes, checksums, malformed versions, mismatches, and overwrite refusal.
  • Mutation/fuzz testing: N/A for this initial source-only documentation/configuration bundle; no compiled core library or executable is shipped. The Scorecard fuzzing recommendation remains open.

5. Ship

  • Reviewed version PR #16 merged, version/manifest/changelog consistent at 0.1.2, and main CI green.
  • Preflight complete and maintainer-authorized release: ready applied before tagging.
  • Signed v0.1.2 tag points to the version PR merge commit; release workflow green.
  • Published ZIP/tar.gz, manifest, notes, and SHA256SUMS downloaded and verified; provenance verified for all five assets; GitHub reports immutable=true. Executable signatures/SBOM: N/A.
  • GitHub Releases is the official channel linked from README. No npm/NuGet/winget/Homebrew publication applies.

Conformance evidence

KofTwentyTwo conformance: KofTwentyTwo/standards (full)

K22-REPO-01  MUST   PASS     LICENSE
K22-REPO-02  MUST   PASS     README.md has every required section
K22-REPO-03  MUST   PASS     .gitignore, .gitattributes (LF), .editorconfig present
K22-REPO-04  MUST   PASS     gitleaks: no findings in history; no open secret-scanning alerts
K22-REPO-05  MUST   PASS     no generated executables or archives tracked
K22-REPO-06  MUST   PASS     SECURITY.md
K22-REPO-07  MUST   PASS     CONTRIBUTING.md
K22-REPO-08  MUST   PASS     .github/CODEOWNERS has a default owner
K22-REPO-09  MUST   N/A      no package manifests found
K22-REPO-10  SHOULD WARN     no KofTwentyTwo/.github repository for shared community files
K22-REPO-11  SHOULD PASS     README shows the Scorecard badge
K22-REPO-20  MUST   PASS     protect-main complete (0 approval(s) for 1 maintainer(s))
K22-REPO-21  MUST   PASS     release tags immutable; only the maintainer creates them
K22-REPO-22  MUST   PASS     squash only, PR title/body, branches auto-deleted
K22-REPO-30  MUST   PASS     PVR, secret scanning + push protection, Dependabot alerts + updates, code scanning, immutable releases
K22-REPO-31  MUST   PASS     read-only token, no PR approvals by workflows, outside contributors need approval
K22-REPO-32  SHOULD WARN     allowed actions: all
K22-REPO-40  MUST   PASS     issues on, wiki off
K22-REPO-41  SHOULD WARN     no homepage
K22-REPO-42  MUST   PASS     listed in MAINTAINERS.md
K22-CI-01    MUST   PASS     requires 9 checks including every standard context
K22-CI-02    MUST   REVIEW   tests run on every PR and push: confirm in the language workflow
K22-CI-03    MUST   REVIEW   CI commands match CONTRIBUTING.md
K22-CI-10    MUST   PASS     10 workflow(s) start read-only
K22-CI-11    MUST   PASS     every action pinned to a commit SHA, every image to a digest
K22-CI-12    MUST   PASS     no untrusted expressions inside run: (zizmor in CI is authoritative)
K22-CI-13    MUST   PASS     no pull_request_target or workflow_run triggers
K22-CI-14    MUST   PASS     every checkout drops its credentials
K22-CI-15    MUST   PASS     release workflows use no caches
K22-CI-16    MUST   PASS     no repository-level secrets
K22-CI-17    MUST   PASS     GitHub-hosted runners only
K22-CI-18    SHOULD PASS     every job has a timeout
K22-CI-20    MUST   PASS     security.yml (secrets job)
K22-CI-21    MUST   PASS     SCA (CVEs and malicious packages) runs on changes and on a schedule
K22-CI-22    MUST   PASS     CodeQL security-extended
K22-CI-23    MUST   PASS     zizmor and actionlint run in CI
K22-CI-24    SHOULD PASS     Scorecard workflow present
K22-CI-30    MUST   PASS     releases through a SHA-pinned KofTwentyTwo/standards release-*.yml reusable workflow
K22-CI-31    MUST   REVIEW   the release workflow re-runs every main gate

N/A: 1  PASS: 32  REVIEW: 3  WARN: 3

Pre-tag evidence: PR #16 merged at fdf5ed0296 with a GitHub Verified signature. Main CI https://github.com/KofTwentyTwo/standards/actions/runs/38060984928 and Scorecard run 38060984600 succeeded. All preflight sections are complete; published-download checks remain pending.

Publication evidence

  • Release: https://github.com/KofTwentyTwo/standards/releases/tag/v0.1.2 (release ID 409011899, immutable=true, draft=false).
  • Entire tag workflow passed: https://github.com/KofTwentyTwo/standards/actions/runs/38061114173.
  • Signed tag object b3dcb53757 and source fdf5ed0296 are GitHub Verified.
  • Downloaded all five published assets. They match the staged attested build byte-for-byte and every GitHub SHA256 digest; SHA256SUMS covers all four other files.
  • Build provenance verified for all five assets, enforcing signer workflow release-standards.yml, exact source commit/ref refs/tags/v0.1.2, and GitHub-hosted runners.
  • gh release verify v0.1.2 passed the separate cryptographically signed immutable-release attestation and all five subject digests.
  • PR #16 now has autorelease: tagged; earlier failed PRs and signed tags remain retired without modification.
# Release checklist: v0.1.2 First published immutable standards bundle, based on `templates/release-checklist.md`. The unpublished v0.1.0 and v0.1.1 tags remain reserved; closed checklists #9 and #14 record those failures. Implementation: #8; publisher corrections: #13 and #15; version proposal: #16. ## 1. Conformance - [x] Full `Test-RepoConformance.ps1 -Repository KofTwentyTwo/standards -LocalPath .` reports zero FAIL and UNKNOWN: 32 PASS, 3 existing WARN, 3 REVIEW, 1 N/A. Full output below. - [x] EX-0001 and EX-0006 are Open and unexpired. The main-only bot key uses EX-0006; unrelated EX-0005 is preserved. - [x] Manual REVIEW rows checked: checker/package tests run on PRs and main; CONTRIBUTING commands match CI; the release reuses all main gates. ## 2. Scans and findings - [x] No open HIGH/CRITICAL code-scanning alerts on main. Required CodeQL, Trivy, workflow, secret, and dependency checks pass. - [x] No open Dependabot alerts for shipped dependencies. - [x] No known shipped vulnerability requiring OpenVEX. Scorecard process alerts #1/#3/#4 have dated dispositions in `docs/security/scorecard-dispositions.md`; LOW #5 and MEDIUM #2 remain open follow-ups. ## 3. Security assessment - [x] Distribution ADR and threat model reviewed, including the v0.1.2 review log and explicit reusable secret contract. - [x] Interfaces: scoped GitHub App tokens, GitHub release API, tag-only protected publication, OIDC provenance, and public archive downloads. No new interface in the corrections. - [x] Most likely failure: unpublished workflow/draft interruption; retain each tag, use a new version for source fixes, and inspect drafts before recovery. Highest impact: compromised credential/upstream Action; scoped installation/tokens, restricted environments, reviewed SHA pins, required gates, and immutable publication limit reach. - [x] App 5263433 and installation 169959557 verified: selected repository KofTwentyTwo/standards only; Contents/PR write, Administration/Metadata read. Secrets remain environment-only. Main/tag protections and release reviewer remain intact; immutability is enabled. ## 4. Test depth - [x] Regression tests cover committed-only ZIP/tar.gz content, hidden files, dirty/untracked exclusion, deterministic output, manifest source, release-specific notes, checksums, malformed versions, mismatches, and overwrite refusal. - [x] Mutation/fuzz testing: N/A for this initial source-only documentation/configuration bundle; no compiled core library or executable is shipped. The Scorecard fuzzing recommendation remains open. ## 5. Ship - [x] Reviewed version PR #16 merged, version/manifest/changelog consistent at 0.1.2, and main CI green. - [x] Preflight complete and maintainer-authorized `release: ready` applied before tagging. - [x] Signed v0.1.2 tag points to the version PR merge commit; release workflow green. - [x] Published ZIP/tar.gz, manifest, notes, and SHA256SUMS downloaded and verified; provenance verified for all five assets; GitHub reports immutable=true. Executable signatures/SBOM: N/A. - [x] GitHub Releases is the official channel linked from README. No npm/NuGet/winget/Homebrew publication applies. ## Conformance evidence ```text KofTwentyTwo conformance: KofTwentyTwo/standards (full) K22-REPO-01 MUST PASS LICENSE K22-REPO-02 MUST PASS README.md has every required section K22-REPO-03 MUST PASS .gitignore, .gitattributes (LF), .editorconfig present K22-REPO-04 MUST PASS gitleaks: no findings in history; no open secret-scanning alerts K22-REPO-05 MUST PASS no generated executables or archives tracked K22-REPO-06 MUST PASS SECURITY.md K22-REPO-07 MUST PASS CONTRIBUTING.md K22-REPO-08 MUST PASS .github/CODEOWNERS has a default owner K22-REPO-09 MUST N/A no package manifests found K22-REPO-10 SHOULD WARN no KofTwentyTwo/.github repository for shared community files K22-REPO-11 SHOULD PASS README shows the Scorecard badge K22-REPO-20 MUST PASS protect-main complete (0 approval(s) for 1 maintainer(s)) K22-REPO-21 MUST PASS release tags immutable; only the maintainer creates them K22-REPO-22 MUST PASS squash only, PR title/body, branches auto-deleted K22-REPO-30 MUST PASS PVR, secret scanning + push protection, Dependabot alerts + updates, code scanning, immutable releases K22-REPO-31 MUST PASS read-only token, no PR approvals by workflows, outside contributors need approval K22-REPO-32 SHOULD WARN allowed actions: all K22-REPO-40 MUST PASS issues on, wiki off K22-REPO-41 SHOULD WARN no homepage K22-REPO-42 MUST PASS listed in MAINTAINERS.md K22-CI-01 MUST PASS requires 9 checks including every standard context K22-CI-02 MUST REVIEW tests run on every PR and push: confirm in the language workflow K22-CI-03 MUST REVIEW CI commands match CONTRIBUTING.md K22-CI-10 MUST PASS 10 workflow(s) start read-only K22-CI-11 MUST PASS every action pinned to a commit SHA, every image to a digest K22-CI-12 MUST PASS no untrusted expressions inside run: (zizmor in CI is authoritative) K22-CI-13 MUST PASS no pull_request_target or workflow_run triggers K22-CI-14 MUST PASS every checkout drops its credentials K22-CI-15 MUST PASS release workflows use no caches K22-CI-16 MUST PASS no repository-level secrets K22-CI-17 MUST PASS GitHub-hosted runners only K22-CI-18 SHOULD PASS every job has a timeout K22-CI-20 MUST PASS security.yml (secrets job) K22-CI-21 MUST PASS SCA (CVEs and malicious packages) runs on changes and on a schedule K22-CI-22 MUST PASS CodeQL security-extended K22-CI-23 MUST PASS zizmor and actionlint run in CI K22-CI-24 SHOULD PASS Scorecard workflow present K22-CI-30 MUST PASS releases through a SHA-pinned KofTwentyTwo/standards release-*.yml reusable workflow K22-CI-31 MUST REVIEW the release workflow re-runs every main gate N/A: 1 PASS: 32 REVIEW: 3 WARN: 3 ``` Pre-tag evidence: PR #16 merged at fdf5ed029603c938615a32b1beca3628b8787945 with a GitHub Verified signature. Main CI https://github.com/KofTwentyTwo/standards/actions/runs/38060984928 and Scorecard run 38060984600 succeeded. All preflight sections are complete; published-download checks remain pending. ## Publication evidence - Release: https://github.com/KofTwentyTwo/standards/releases/tag/v0.1.2 (release ID 409011899, immutable=true, draft=false). - Entire tag workflow passed: https://github.com/KofTwentyTwo/standards/actions/runs/38061114173. - Signed tag object b3dcb53757a74044259912dae37a49edc0c98b49 and source fdf5ed029603c938615a32b1beca3628b8787945 are GitHub Verified. - Downloaded all five published assets. They match the staged attested build byte-for-byte and every GitHub SHA256 digest; SHA256SUMS covers all four other files. - Build provenance verified for all five assets, enforcing signer workflow release-standards.yml, exact source commit/ref refs/tags/v0.1.2, and GitHub-hosted runners. - gh release verify v0.1.2 passed the separate cryptographically signed immutable-release attestation and all five subject digests. - PR #16 now has autorelease: tagged; earlier failed PRs and signed tags remain retired without modification.
KofTwentyTwo commented 2026-10-10 14:53:38 +00:00 (Migrated from github.com)
Copy link
Copy source

Published and verified immutable v0.1.2. All shipping checks are complete with download, checksum, build provenance, signed release-attestation, and green workflow evidence in the checklist.

Published and verified immutable v0.1.2. All shipping checks are complete with download, checksum, build provenance, signed release-attestation, and green workflow evidence in the checklist.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 autorelease: failed
Reserved version tag; no published release
 autorelease: pending
autorelease: tagged
breaking
Incompatible new mandatory standards; requires a MAJOR release
 bug
Something isn't working
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 release: failed
Reserved release tag failed before public publication; preserved for audit.
 release: ready
Maintainer-approved release preflight
 wontfix
This will not be worked on
No labels release: ready
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#17