feat(releases): publish immutable standards bundles #8

2026-10-10T13:51:35Z

KofTwentyTwo commented

2026-10-10 13:51:35 +00:00

(Migrated from github.com)

What

Publish committed standards as versioned ZIP/tar.gz bundles with a source manifest, SHA256SUMS, release notes, and GitHub build attestations. Release Please proposes reviewed semantic version PRs; maintainer-created tags invoke all existing CI gates and protected immutable publication. First version: 0.1.0. Closes #7.

Why

Consumers need a complete snapshot whose version identifies permanent bytes and a verifiable source commit across languages and operating systems.

How it was tested

Package regression fixtures verify committed-only content, hidden files, both archive formats, deterministic output, checksum coverage, version/changelog validation, and refusal to overwrite output. Checker self-tests, static conformance, actionlint, zizmor (offline), markdownlint, internal links, gitleaks, and separate-process PSScriptAnalyzer checks pass. Live CI will re-run required checks before merge.

GitHub setup and scope

Immutable releases are already enabled. Configure release-automation for main only and release for v* tags with KofTwentyTwo approval and no admin bypass. An App installed only on this repository gets Contents/PR write and Administration read, no ruleset bypass. Its key stays in environment secrets. EX-0006 records only the main-only version-bot key exception; main/tag rulesets and GITHUB_TOKEN PR restrictions remain intact. MINOR/MAJOR checklists receive release: ready after preflight; post-publication verification remains pending until shipping.

Checklist

Commits signed and DCO signed off
Format/lint clean; no application build required
Behavioral package tests added; no existing coverage gate
Contributor guide, distribution ADR, threat model, and release instructions included
No secrets or private data in the patch
New SHA-pinned actions justified for version proposals, scoped App tokens, and provenance; no runtime dependencies
Substantial AI assistance: Codex (GPT-6); maintainer review and release approval remain required

## What Publish committed standards as versioned ZIP/tar.gz bundles with a source manifest, SHA256SUMS, release notes, and GitHub build attestations. Release Please proposes reviewed semantic version PRs; maintainer-created tags invoke all existing CI gates and protected immutable publication. First version: **0.1.0**. Closes #7. ## Why Consumers need a complete snapshot whose version identifies permanent bytes and a verifiable source commit across languages and operating systems. ## How it was tested Package regression fixtures verify committed-only content, hidden files, both archive formats, deterministic output, checksum coverage, version/changelog validation, and refusal to overwrite output. Checker self-tests, static conformance, actionlint, zizmor (offline), markdownlint, internal links, gitleaks, and separate-process PSScriptAnalyzer checks pass. Live CI will re-run required checks before merge. ## GitHub setup and scope Immutable releases are already enabled. Configure `release-automation` for main only and `release` for v* tags with KofTwentyTwo approval and no admin bypass. An App installed only on this repository gets Contents/PR write and Administration read, no ruleset bypass. Its key stays in environment secrets. EX-0006 records only the main-only version-bot key exception; main/tag rulesets and GITHUB_TOKEN PR restrictions remain intact. MINOR/MAJOR checklists receive `release: ready` after preflight; post-publication verification remains pending until shipping. ## Checklist - [x] Commits signed and DCO signed off - [x] Format/lint clean; no application build required - [x] Behavioral package tests added; no existing coverage gate - [x] Contributor guide, distribution ADR, threat model, and release instructions included - [x] No secrets or private data in the patch - [x] New SHA-pinned actions justified for version proposals, scoped App tokens, and provenance; no runtime dependencies - [x] Substantial AI assistance: Codex (GPT-6); maintainer review and release approval remain required

KofTwentyTwo (Migrated from github.com) reviewed

2026-10-10 13:56:21 +00:00

KofTwentyTwo (Migrated from github.com) left a comment

Automated code review (Codex, GPT-6)

Reviewed the implementation at 92c2b3a, including archives, manifest/version/changelog validation, checksum coverage, action pins, token scopes, release-PR association, main ancestry, environment restrictions, immutable draft publication, and failure recovery.

Findings resolved:

A checklist required to be closed before tagging could only close after publication. Validation now requires maintainer-controlled release: ready preflight approval and keeps post-publication checks pending.
EX-0005 had been assigned to agent operations on main; this change uses new EX-0006 throughout and preserves existing exceptions.
First-release/draft text assumed 1.0.0. Bootstrap is 0.1.0 and standards/response commitments remain explicitly pre-1.0.
Existing HIGH Scorecard process findings now have evidence-backed dispositions and a reassessment date; main protections and scanners remain enabled.

No remaining code-review blockers identified. Behavioral package regressions and local quality gates passed; required GitHub checks must pass for the current head before merge. This is AI review, not an independent human approval. App credential provisioning and actual tag publication remain live integration checks in the release checklist.

## Automated code review (Codex, GPT-6) Reviewed the implementation at 92c2b3a, including archives, manifest/version/changelog validation, checksum coverage, action pins, token scopes, release-PR association, main ancestry, environment restrictions, immutable draft publication, and failure recovery. Findings resolved: - A checklist required to be closed before tagging could only close after publication. Validation now requires maintainer-controlled `release: ready` preflight approval and keeps post-publication checks pending. - EX-0005 had been assigned to agent operations on main; this change uses new EX-0006 throughout and preserves existing exceptions. - First-release/draft text assumed 1.0.0. Bootstrap is 0.1.0 and standards/response commitments remain explicitly pre-1.0. - Existing HIGH Scorecard process findings now have evidence-backed dispositions and a reassessment date; main protections and scanners remain enabled. No remaining code-review blockers identified. Behavioral package regressions and local quality gates passed; required GitHub checks must pass for the current head before merge. This is AI review, not an independent human approval. App credential provisioning and actual tag publication remain live integration checks in the release checklist.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#8