james.maesandCodex
fbd9757d33
## What Publish committed standards as versioned ZIP/tar.gz bundles with a source manifest, SHA256SUMS, release notes, and GitHub build attestations. Release Please proposes reviewed semantic version PRs; maintainer-created tags invoke all existing CI gates and protected immutable publication. First version: **0.1.0**. Closes #7. ## Why Consumers need a complete snapshot whose version identifies permanent bytes and a verifiable source commit across languages and operating systems. ## How it was tested Package regression fixtures verify committed-only content, hidden files, both archive formats, deterministic output, checksum coverage, version/changelog validation, and refusal to overwrite output. Checker self-tests, static conformance, actionlint, zizmor (offline), markdownlint, internal links, gitleaks, and separate-process PSScriptAnalyzer checks pass. Live CI will re-run required checks before merge. ## GitHub setup and scope Immutable releases are already enabled. Configure `release-automation` for main only and `release` for v* tags with KofTwentyTwo approval and no admin bypass. An App installed only on this repository gets Contents/PR write and Administration read, no ruleset bypass. Its key stays in environment secrets. EX-0006 records only the main-only version-bot key exception; main/tag rulesets and GITHUB_TOKEN PR restrictions remain intact. MINOR/MAJOR checklists receive `release: ready` after preflight; post-publication verification remains pending until shipping. ## Checklist - [x] Commits signed and DCO signed off - [x] Format/lint clean; no application build required - [x] Behavioral package tests added; no existing coverage gate - [x] Contributor guide, distribution ADR, threat model, and release instructions included - [x] No secrets or private data in the patch - [x] New SHA-pinned actions justified for version proposals, scoped App tokens, and provenance; no runtime dependencies - [x] Substantial AI assistance: Codex (GPT-6); maintainer review and release approval remain required Security review: docs/security/scorecard-dispositions.md records the Scorecard process alerts and 2027-01-10 reassessment. Automated code review is posted on this PR; all current required checks passed. Signed-off-by: James Maes <james@kof22.com> Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
12 lines
463 B
YAML
12 lines
463 B
YAML
# zizmor configuration for this repository (configs/security/zizmor.yml is the
|
|
# template for consuming repositories).
|
|
rules:
|
|
self-repository:
|
|
# ci.yml calls this repository's reusable workflows by local path so changes
|
|
# are tested before release. GitHub's newer `$/...` self-repository syntax is
|
|
# not yet understood by actionlint 1.7.12, which is also a required gate.
|
|
ignore:
|
|
- ci.yml
|
|
- release.yml
|
|
- release-standards.yml
|