diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 6ed2e48..11fea0f 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1 +1 @@ -{".":"0.1.2"} +{".":"1.0.0"} diff --git a/CHANGELOG.md b/CHANGELOG.md index 36b0295..b95992b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,23 @@ +## 1.0.0 (2026-10-10) + + + +## What's Changed +### Breaking changes +* feat(assurance)!: require applicable fuzzing and badge participation by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/19 +### Changes +* fix(releases): use professional repository and automation text by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/23 +* fix(releases): allow native formatting in generated changelog by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/24 +* docs(assurance): record OpenSSF passing badge by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/25 +* docs(exceptions): scope temporary frontend audit exception by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/27 +* ci(release-velopack): sign only unsigned files; verify before packing by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/29 + + +**Full Changelog**: https://github.com/KofTwentyTwo/standards/compare/v0.1.2...v1.0.0 + ## [0.1.2](https://github.com/KofTwentyTwo/standards/compare/v0.1.1...v0.1.2) (2026-10-10) First published standards bundle: policies, language profiles, architectures, diff --git a/README.md b/README.md index 378a59f..6016147 100644 --- a/README.md +++ b/README.md @@ -8,23 +8,22 @@ reusable GitHub Actions workflows, repository templates, and a conformance check [![Docs: CC BY 4.0](https://img.shields.io/badge/docs-CC%20BY%204.0-lightgrey)](LICENSE-docs) [![Code: MIT](https://img.shields.io/badge/code-MIT-green)](LICENSE) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15366/badge)](https://www.bestpractices.dev/projects/15366) -[![Status: draft](https://img.shields.io/badge/status-draft%20(pre--1.0)-orange)](#status) +[![Status: versioned](https://img.shields.io/badge/status-versioned-blue)](#status) ## Status -> **Draft standards, before `v1.0.0`.** The requirements are written and the -> enforcement tooling exists, but no KofTwentyTwo repository has been verified against -> them yet; adoption starts with this repository, then -> [AppKit](https://github.com/KofTwentyTwo/AppKit) and -> [gclo](https://github.com/KofTwentyTwo/gclo). The compliance crosswalks therefore list -> controls as **Defined**, not met, and the response times in the security program are -> targets until `v1.0.0`. See [how these standards work](policies/README.md). +> **Versioned standards with repository-specific adoption.** Immutable releases +> identify each published baseline. This repository has completed repository and CI +> conformance checks; other repositories record their own checks and exceptions. +> Compliance crosswalks describe requirements and evidence for individual controls. +> See [how these standards work](policies/README.md) and the +> [release checklists](https://github.com/KofTwentyTwo/standards/issues?q=is%3Aissue+%22Release+v%22). --- -**Tier:** Product ([scope](policies/README.md#scope)). **Conformance:** this repository is -the first to adopt the standards; it will state *Conforms to KofTwentyTwo standards -v1.0* once the checker passes on it. +**Tier:** Product ([scope](policies/README.md#scope)). **Conformance:** repository and +CI checks reviewed on 2026-10-10: zero FAIL or UNKNOWN, with manual review items +resolved in the release checklist and approved [exceptions](exceptions/register.md). ## How to use diff --git a/docs/releases.md b/docs/releases.md index a093268..62fdcb8 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -132,7 +132,7 @@ same Git/archive tool versions. The builder refuses an existing output directory The initial `v0.1.0` tag was reserved by a workflow-startup failure; no bundle was published for it. The `v0.1.1` publisher then stopped before draft creation because the caller omitted the environment secret contract. Both tags remain reserved; -`v0.1.2` is the planned first published bundle. Keep these tags unchanged; use a new +`v0.1.2` is the first published bundle. Keep these tags unchanged; use a new version when a tagged workflow needs a source fix. Never replace published assets or move/reuse a version tag. Fix a published error @@ -145,3 +145,14 @@ from `autorelease: pending` to `autorelease: tagged`; do not rebuild the release References: [GitHub immutable releases](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases), [enabling immutability](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/prevent-release-changes), and [Release Please token behavior](https://github.com/googleapis/release-please-action#other-actions-on-release-please-prs). + +## Known limitations + +[Issue #22](https://github.com/KofTwentyTwo/standards/issues/22) tracks Windows App SDK +publish resources and the missing shared launch-smoke gate in `release-velopack.yml`. +Windows consumers must keep `WindowsAppSDKSelfContained` and `WindowsPackageType` +consistent between build and publish, or clean intermediate output before publish. +Run smoke tests against the published executable and test the installer on a clean +machine before a stable application release. This remains a consumer-side check +until the shared workflow implements it. The standards bundle contains source and +configuration; it does not contain a compiled Windows application. diff --git a/docs/security/threat-model.md b/docs/security/threat-model.md index cf1ee27..21636ad 100644 --- a/docs/security/threat-model.md +++ b/docs/security/threat-model.md @@ -1,6 +1,6 @@ # Threat model: standards distribution -- **Version reviewed:** v0.1.0 release-bundle implementation +- **Version reviewed:** v1.0.0 standards baseline - **Last updated:** 2026-10-10 - **Status:** Implementation reviewed; provisioning is verified in the release checklist. @@ -71,6 +71,21 @@ trust boundaries change. ## Review log +- **2026-10-10, v1.0.0:** Reviewed changes since v0.1.2: mandatory applicable badge + participation and parser fuzzing, completed passing self-assessment, professional + release text, scoped frontend audit exception, and unsigned-file-only Windows + signing with verification before packing. Distribution credentials, channels, + environment restrictions and provenance boundaries remain unchanged. Badge + metadata adds a public provider link; fuzzing executes synthetic local inputs. + Signing continues to use the Windows consumer's existing Azure OIDC boundary. + The most likely release interruption remains a failed gate or unpublished draft; + recovery preserves tags and immutable assets. The highest-impact distribution + threat remains a compromised credential or pinned Action, constrained by the + existing scoped tokens, protected environments and required checks. Windows + publish/resource and launch-smoke limitations remain tracked in + [issue #22](https://github.com/KofTwentyTwo/standards/issues/22); consumer workarounds + and rehearsal expectations are recorded in [release guidance](../releases.md#known-limitations). + - **2026-10-10, v0.1.2:** Reviewed the explicit reusable-workflow secret contract after the unpublished v0.1.1 publisher failed. Only the named App key is passed; its value remains restricted to the reviewer-protected tag environment. Nested diff --git a/policies/README.md b/policies/README.md index 984f8b2..32dfd22 100644 --- a/policies/README.md +++ b/policies/README.md @@ -1,16 +1,12 @@ # How these standards work -> **Status: draft, pre-v1.0.0.** The requirements are written but have not been -> released. Until the first release (`v1.0.0`): -> -> - the automated checks and conformance tooling are still being built, so no -> requirement is yet *Enforced* or *Verified* (see [compliance](../compliance/README.md)); -> - no KofTwentyTwo repository claims conformance; adoption is in progress, starting -> with this repository, [AppKit](https://github.com/KofTwentyTwo/AppKit), and -> [gclo](https://github.com/KofTwentyTwo/gclo); -> - commitments to people outside the project (vulnerability response and fix times in -> the [security program](security-program.md#vulnerability-management)) are targets -> that the maintainer works to, and become binding commitments at `v1.0.0`. +> **Status: versioned baseline.** Published tags identify immutable requirements. +> Each repository adopts a specific version and records its own conformance evidence +> and approved exceptions. [Compliance](../compliance/README.md) labels describe the +> evidence for each mapped control; publication alone does not verify every consumer. +> External vulnerability response and fix deadlines in the +> [security program](security-program.md#vulnerability-management) become binding +> commitments with adoption of the stable `v1.0.0` baseline. This repository is the single source of truth for how KofTwentyTwo builds, secures, and ships software. It has three layers, each more specific than the last: diff --git a/version.txt b/version.txt index d917d3e..3eefcb9 100644 --- a/version.txt +++ b/version.txt @@ -1 +1 @@ -0.1.2 +1.0.0