Release v1.0.0 #30

New Issue

2026-10-10T21:21:41Z

KofTwentyTwo commented

2026-10-10 21:21:41 +00:00

(Migrated from github.com)

Release checklist: v1.0.0

Immutable source-only standards bundle. The maintainer authorized merging and publishing the complete release. Version proposal: #20. Breaking change: #19 makes applicable badge participation and untrusted-input parser fuzzing mandatory. Includes the passing badge, professional release text, scoped frontend audit exception, Windows signing correction, and stable-baseline readiness documentation.

1. Conformance

Full repository conformance reports zero FAIL or UNKNOWN: 32 PASS, 5 REVIEW, 3 existing WARN, 1 N/A. Output attached below.
Relied-on EX-0001 and EX-0006 are open and unexpired. EX-0007 is closed after passing badge integration; unrelated exceptions are preserved.
Manual reviews completed: assessment 15366 belongs to this repository and is passing; 90-day review recorded; PR/main and weekly/tag fuzz budgets and replay properties reviewed; tests and documented commands match CI; the publisher reruns all main gates.

2. Scans and findings

No open HIGH/CRITICAL code-scanning alerts on main. Required secret, workflow, dependency, CodeQL and SCA gates pass on the release proposal.
No open Dependabot alerts.
No known non-exploitable vulnerability requiring an OpenVEX statement. The remaining MEDIUM Scorecard fuzzing finding is a detection limitation for the native PowerShell harness, with evidence in docs/security/fuzzing.md and scorecard-dispositions.md. Do not invent a supported integration or vulnerability statement.

3. Security assessment

Distribution threat model reviewed against all changes since v0.1.2; v1.0.0 review log updated in the release PR.
Interfaces: public assessment provider link and synthetic local fuzz inputs; existing GitHub publication and Azure signing boundaries remain unchanged. No new distribution credential, channel or trust boundary.
Most likely problem: failed gate or unpublished draft; preserve tags, inspect drafts, and recover without replacing immutable assets. Highest-impact problem: compromised credential or pinned Action; existing scoped tokens, protected environments, SHA pins, provenance and immutable releases constrain it.
Known non-security limitation #22 remains open: Windows consumers must use consistent self-contained build/publish properties or clean intermediate output, smoke-test the published executable, and test the installer on a clean machine. Source-only standards publication does not attest that every consumer application passes its own release gates.

4. Test depth

Package regressions pass, including committed-only ZIP/tar.gz contents, hidden configs, manifests, release-specific native headings, reproducibility, checksums, malformed versions and overwrite refusal.
Parser fuzzing passes at release budget: seeds 22023 and 99173, each 10000 cases and 160000 assertions; total 320000 assertions. Deterministic regressions and replay are retained.
Mutation testing for core libraries: N/A; this distribution has no compiled core library. Executable checker behavior is covered by self-tests and generated parser properties; no whole-tool coverage claim is made.
Markdown lint and offline links/anchors pass for all 69 documents; git diff --check passes.

5. Ship

Release PR #20 merged at GitHub-verified 7c6936844323230546a9bcf6aa7610f5c43e1013; version/manifest/changelog are 1.0.0. Main CI 38087400248 and Scorecard 38087400108 succeeded. Breaking changes and notes reviewed; maintainer-authorized preflight approved with release: ready before tagging.
GitHub-verified signed v1.0.0 tag object a97f0d26d8 points to release PR merge commit 7c69368443 and links this checklist. Release workflow 38087498451 succeeded, including the normal maintainer-authorized protected environment review.
All five published assets downloaded and compared with the staged workflow artifacts. Four SHA256SUMS entries, all five GitHub digests and source/ref/signer-bound build attestations passed; self-hosted runners denied. GitHub immutable-release attestation passed. Release 409215815 confirms immutable=true, draft=false, prerelease=false. Manifest identifies the exact source; packaged README includes the earned badge and accurate versioned status. Compiled SBOM/platform signatures: N/A for this source-only bundle.
GitHub Releases is the official distribution channel linked from README. No registry or external announcement required.

Conformance evidence

KofTwentyTwo conformance: KofTwentyTwo/standards (full)

K22-REPO-01  MUST   PASS     LICENSE
K22-REPO-02  MUST   PASS     README.md has every required section
K22-REPO-03  MUST   PASS     .gitignore, .gitattributes (LF), .editorconfig present
K22-REPO-04  MUST   PASS     gitleaks: no findings in history; no open secret-scanning alerts
K22-REPO-05  MUST   PASS     no generated executables or archives tracked
K22-REPO-06  MUST   PASS     SECURITY.md
K22-REPO-07  MUST   PASS     CONTRIBUTING.md
K22-REPO-08  MUST   PASS     .github/CODEOWNERS has a default owner
K22-REPO-09  MUST   N/A      no package manifests found
K22-REPO-10  SHOULD WARN     no KofTwentyTwo/.github repository for shared community files
K22-REPO-11  SHOULD PASS     README shows the Scorecard badge
K22-REPO-12  MUST   REVIEW   badge linked; verify https://www.bestpractices.dev/projects/15366 belongs to this repository, current answers and 90-day review in docs/security/best-practices.md
K22-TEST-25  MUST   REVIEW   fuzz targets and run command found; verify required PR/main gate, weekly/release budgets, properties and replay in docs/security/fuzzing.md
K22-REPO-20  MUST   PASS     protect-main complete (0 approval(s) for 1 maintainer(s))
K22-REPO-21  MUST   PASS     release tags immutable; only the maintainer creates them
K22-REPO-22  MUST   PASS     squash only, PR title/body, branches auto-deleted
K22-REPO-30  MUST   PASS     PVR, secret scanning + push protection, Dependabot alerts + updates, code scanning, immutable releases
K22-REPO-31  MUST   PASS     read-only token, no PR approvals by workflows, outside contributors need approval
K22-REPO-32  SHOULD WARN     allowed actions: all
K22-REPO-40  MUST   PASS     issues on, wiki off
K22-REPO-41  SHOULD WARN     no homepage
K22-REPO-42  MUST   PASS     listed in MAINTAINERS.md
K22-CI-01    MUST   PASS     requires 9 checks including every standard context
K22-CI-02    MUST   REVIEW   tests run on every PR and push: confirm in the language workflow
K22-CI-03    MUST   REVIEW   CI commands match CONTRIBUTING.md
K22-CI-10    MUST   PASS     10 workflow(s) start read-only
K22-CI-11    MUST   PASS     every action pinned to a commit SHA, every image to a digest
K22-CI-12    MUST   PASS     no untrusted expressions inside run: (zizmor in CI is authoritative)
K22-CI-13    MUST   PASS     no pull_request_target or workflow_run triggers
K22-CI-14    MUST   PASS     every checkout drops its credentials
K22-CI-15    MUST   PASS     release workflows use no caches
K22-CI-16    MUST   PASS     no repository-level secrets
K22-CI-17    MUST   PASS     GitHub-hosted runners only
K22-CI-18    SHOULD PASS     every job has a timeout
K22-CI-20    MUST   PASS     security.yml (secrets job)
K22-CI-21    MUST   PASS     SCA (CVEs and malicious packages) runs on changes and on a schedule
K22-CI-22    MUST   PASS     CodeQL security-extended
K22-CI-23    MUST   PASS     zizmor and actionlint run in CI
K22-CI-24    SHOULD PASS     Scorecard workflow present
K22-CI-30    MUST   PASS     releases through a SHA-pinned KofTwentyTwo/standards release-*.yml reusable workflow
K22-CI-31    MUST   REVIEW   the release workflow re-runs every main gate

N/A: 1  PASS: 32  REVIEW: 5  WARN: 3

Published release

https://github.com/KofTwentyTwo/standards/releases/tag/v1.0.0

Published 2026-10-10T21:26:33Z. PR #20 is autorelease: tagged. Existing v0.1.2 assets and reserved unpublished v0.1.0/v0.1.1 tags were preserved. Verification evidence is retained locally in standards-release-validation, including all asset provenance JSON, the immutable-release attestation, and downloaded published/staged bundles. Known Windows workflow follow-up #22 remains open and documented.

# Release checklist: v1.0.0 Immutable source-only standards bundle. The maintainer authorized merging and publishing the complete release. Version proposal: #20. Breaking change: #19 makes applicable badge participation and untrusted-input parser fuzzing mandatory. Includes the passing badge, professional release text, scoped frontend audit exception, Windows signing correction, and stable-baseline readiness documentation. ## 1. Conformance - [x] Full repository conformance reports zero FAIL or UNKNOWN: 32 PASS, 5 REVIEW, 3 existing WARN, 1 N/A. Output attached below. - [x] Relied-on EX-0001 and EX-0006 are open and unexpired. EX-0007 is closed after passing badge integration; unrelated exceptions are preserved. - [x] Manual reviews completed: assessment 15366 belongs to this repository and is passing; 90-day review recorded; PR/main and weekly/tag fuzz budgets and replay properties reviewed; tests and documented commands match CI; the publisher reruns all main gates. ## 2. Scans and findings - [x] No open HIGH/CRITICAL code-scanning alerts on main. Required secret, workflow, dependency, CodeQL and SCA gates pass on the release proposal. - [x] No open Dependabot alerts. - [x] No known non-exploitable vulnerability requiring an OpenVEX statement. The remaining MEDIUM Scorecard fuzzing finding is a detection limitation for the native PowerShell harness, with evidence in docs/security/fuzzing.md and scorecard-dispositions.md. Do not invent a supported integration or vulnerability statement. ## 3. Security assessment - [x] Distribution threat model reviewed against all changes since v0.1.2; v1.0.0 review log updated in the release PR. - [x] Interfaces: public assessment provider link and synthetic local fuzz inputs; existing GitHub publication and Azure signing boundaries remain unchanged. No new distribution credential, channel or trust boundary. - [x] Most likely problem: failed gate or unpublished draft; preserve tags, inspect drafts, and recover without replacing immutable assets. Highest-impact problem: compromised credential or pinned Action; existing scoped tokens, protected environments, SHA pins, provenance and immutable releases constrain it. - [x] Known non-security limitation #22 remains open: Windows consumers must use consistent self-contained build/publish properties or clean intermediate output, smoke-test the published executable, and test the installer on a clean machine. Source-only standards publication does not attest that every consumer application passes its own release gates. ## 4. Test depth - [x] Package regressions pass, including committed-only ZIP/tar.gz contents, hidden configs, manifests, release-specific native headings, reproducibility, checksums, malformed versions and overwrite refusal. - [x] Parser fuzzing passes at release budget: seeds 22023 and 99173, each 10000 cases and 160000 assertions; total 320000 assertions. Deterministic regressions and replay are retained. - [x] Mutation testing for core libraries: N/A; this distribution has no compiled core library. Executable checker behavior is covered by self-tests and generated parser properties; no whole-tool coverage claim is made. - [x] Markdown lint and offline links/anchors pass for all 69 documents; git diff --check passes. ## 5. Ship - [x] Release PR #20 merged at GitHub-verified 7c6936844323230546a9bcf6aa7610f5c43e1013; version/manifest/changelog are 1.0.0. Main CI 38087400248 and Scorecard 38087400108 succeeded. Breaking changes and notes reviewed; maintainer-authorized preflight approved with release: ready before tagging. - [x] GitHub-verified signed v1.0.0 tag object a97f0d26d87b1a1972e3519c2fe9bc621a9c388f points to release PR merge commit 7c6936844323230546a9bcf6aa7610f5c43e1013 and links this checklist. Release workflow 38087498451 succeeded, including the normal maintainer-authorized protected environment review. - [x] All five published assets downloaded and compared with the staged workflow artifacts. Four SHA256SUMS entries, all five GitHub digests and source/ref/signer-bound build attestations passed; self-hosted runners denied. GitHub immutable-release attestation passed. Release 409215815 confirms immutable=true, draft=false, prerelease=false. Manifest identifies the exact source; packaged README includes the earned badge and accurate versioned status. Compiled SBOM/platform signatures: N/A for this source-only bundle. - [x] GitHub Releases is the official distribution channel linked from README. No registry or external announcement required. ## Conformance evidence ```text KofTwentyTwo conformance: KofTwentyTwo/standards (full) K22-REPO-01 MUST PASS LICENSE K22-REPO-02 MUST PASS README.md has every required section K22-REPO-03 MUST PASS .gitignore, .gitattributes (LF), .editorconfig present K22-REPO-04 MUST PASS gitleaks: no findings in history; no open secret-scanning alerts K22-REPO-05 MUST PASS no generated executables or archives tracked K22-REPO-06 MUST PASS SECURITY.md K22-REPO-07 MUST PASS CONTRIBUTING.md K22-REPO-08 MUST PASS .github/CODEOWNERS has a default owner K22-REPO-09 MUST N/A no package manifests found K22-REPO-10 SHOULD WARN no KofTwentyTwo/.github repository for shared community files K22-REPO-11 SHOULD PASS README shows the Scorecard badge K22-REPO-12 MUST REVIEW badge linked; verify https://www.bestpractices.dev/projects/15366 belongs to this repository, current answers and 90-day review in docs/security/best-practices.md K22-TEST-25 MUST REVIEW fuzz targets and run command found; verify required PR/main gate, weekly/release budgets, properties and replay in docs/security/fuzzing.md K22-REPO-20 MUST PASS protect-main complete (0 approval(s) for 1 maintainer(s)) K22-REPO-21 MUST PASS release tags immutable; only the maintainer creates them K22-REPO-22 MUST PASS squash only, PR title/body, branches auto-deleted K22-REPO-30 MUST PASS PVR, secret scanning + push protection, Dependabot alerts + updates, code scanning, immutable releases K22-REPO-31 MUST PASS read-only token, no PR approvals by workflows, outside contributors need approval K22-REPO-32 SHOULD WARN allowed actions: all K22-REPO-40 MUST PASS issues on, wiki off K22-REPO-41 SHOULD WARN no homepage K22-REPO-42 MUST PASS listed in MAINTAINERS.md K22-CI-01 MUST PASS requires 9 checks including every standard context K22-CI-02 MUST REVIEW tests run on every PR and push: confirm in the language workflow K22-CI-03 MUST REVIEW CI commands match CONTRIBUTING.md K22-CI-10 MUST PASS 10 workflow(s) start read-only K22-CI-11 MUST PASS every action pinned to a commit SHA, every image to a digest K22-CI-12 MUST PASS no untrusted expressions inside run: (zizmor in CI is authoritative) K22-CI-13 MUST PASS no pull_request_target or workflow_run triggers K22-CI-14 MUST PASS every checkout drops its credentials K22-CI-15 MUST PASS release workflows use no caches K22-CI-16 MUST PASS no repository-level secrets K22-CI-17 MUST PASS GitHub-hosted runners only K22-CI-18 SHOULD PASS every job has a timeout K22-CI-20 MUST PASS security.yml (secrets job) K22-CI-21 MUST PASS SCA (CVEs and malicious packages) runs on changes and on a schedule K22-CI-22 MUST PASS CodeQL security-extended K22-CI-23 MUST PASS zizmor and actionlint run in CI K22-CI-24 SHOULD PASS Scorecard workflow present K22-CI-30 MUST PASS releases through a SHA-pinned KofTwentyTwo/standards release-*.yml reusable workflow K22-CI-31 MUST REVIEW the release workflow re-runs every main gate N/A: 1 PASS: 32 REVIEW: 5 WARN: 3 ``` ## Published release https://github.com/KofTwentyTwo/standards/releases/tag/v1.0.0 Published 2026-10-10T21:26:33Z. PR #20 is autorelease: tagged. Existing v0.1.2 assets and reserved unpublished v0.1.0/v0.1.1 tags were preserved. Verification evidence is retained locally in standards-release-validation, including all asset provenance JSON, the immutable-release attestation, and downloaded published/staged bundles. Known Windows workflow follow-up #22 remains open and documented.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#30