KofTwentyTwo/standards
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

Release v1.1.0 #40

New Issue
Closed
opened 2026-10-12 15:06:17 +00:00 by KofTwentyTwo · 2 comments
KofTwentyTwo commented 2026-10-12 15:06:17 +00:00 (Migrated from github.com)
Copy link
Copy source

Release checklist: v1.1.0

Prepared for the reviewed signing builder from PR #31 and its six-reference follow-up PR #39 plus the reviewed analyzer fix PR #41. Publication is authorized by the maintainer; the release must use the established Release Please proposal, its merge commit and the protected tag/environment workflow. All preflight items are complete. Post-publication asset verification remains open and is not claimed before the workflow publishes.

1. Conformance

  • Live full conformance has no FAIL: 33 PASS, 1 N/A, 5 explicitly reviewed/manual items and 2 SHOULD warnings (allowed-actions scope and homepage).
  • Applicable EX-0001 single-maintainer and EX-0006 version-bot environment exceptions are open/unexpired; no new exception is approved here.
  • Actual Best Practices project 15366 identifies this exact standards repository and currently displays passing/100%; current assessment and next review are recorded.

2. Scans and findings

  • No open HIGH/CRITICAL code-scanning alerts or Dependabot findings in the latest live API query. Existing process-only Scorecard dispositions remain explicit; no fictitious OpenVEX statement.
  • Main's six helper-reference findings are fixed by reviewed/merged PR #39. Reviewed/merged PR #41 corrects the reproduced analyzer race without dropping any rule/test/deadline; exact main 7c44ceaa CI38274931168 and release proposal 2435f34 CI38275074089 are terminal green.
  • No confirmed shipped vulnerability requiring OpenVEX was identified. New findings must be reassessed before tagging.

3. Security assessment

  • Existing threat-model review log covers the signing extension: explicit ownership catalog, valid publisher/trust/digests/timestamps, third-party preservation, installer embedded-package hash and fail-closed publication.
  • Changed interfaces are optional catalog inputs and protected release OIDC/Artifact Signing calls; untrusted PR code has no signing access.
  • Primary risks: signing another publisher's files, credential access from untrusted jobs and shipping altered/unsigned package bytes. Required catalog/publisher/PE checks, protected environments, byte preservation and final distribution verification address these risks.
  • Maintainer personally confirmed review/resolution of exact PR #31. PR #39's six references point to byte-identical reviewed helpers on signed main; its separate human confirmation was supplied. Maintainer also personally confirmed review/resolved findings for PR #41 at 1e2179a; it is merged as verified-signed 7c44ceaa.

4. Test depth

  • Mutation applicability/limit recorded: no code-mutation campaign or mutation score is established for the shipped PowerShell tooling. K22-TEST-11 is a SHOULD; behavioral, property and generated-input checks below do not constitute mutation coverage. This remains an explicit assurance gap for maintainer review rather than a claim of non-applicability.
  • Both required pre-minor parser campaigns complete with actual process exit 0: seeds 22023 and 99173, 10000 iterations and 160000 security-property assertions each; zero failures. The first earlier wrapper checked an inherited native exit value despite PASS; separate-process execution confirms the actual exit status.
  • All 35 signing/wrapper regression tests pass, zero skips; required hosted conformance/package/security/signing tests for PR #39 pass.
  • Representative local six-binary and final installer/portable/full-package signing integration passes actual SHA256/RFC3161/publisher/trust checks, third-party byte preservation and exact embedded-package verification. This is interactive local proof; consumer protected CI OIDC remains to be proved after publication.

5. Ship

  • PR #39 and PR #41 human review confirmed, both merged; corrected main required checks are green.
  • Release Please proposal updated to 1.1.0 at 2435f34; inspected its exact three-file version/changelog/manifest diff and all required checks passed before the authorized protected squash merge of PR #34. No new implementation was added by the version bot. Exact signed merge93b1d616 main CI38275325018 is terminal green; tag this merge commit.
  • Preflight complete; existing explicit owner release authorization covers the maintainer release-ready label and signed tag at release PR34 merge93b1d616 with this checklist URL. Post-publication items below remain pending.
  • Protected releaseCI38275622522 is terminal green; five actual assets downloaded, all four SHA256SUMS entries and all five provenance attestations verify. Release is immutable. Source ZIP contains exact committed version/builder/module/composite bytes at93b1d616; source bundle compiled-platform signatures/SBOM are not applicable.
  • Published bundle inspected, archive hashes/provenance verified; close this standards checklist. MarkdownViewr adopts the published full-SHA builder in its separate signing change and must still prove its protected CI identity/final application artifacts. Evidence retained in artifacts/standards-1.1.0-93b1d61; no application release is claimed.
Actual full conformance output 
KofTwentyTwo conformance: KofTwentyTwo/standards (full)

K22-REPO-01  MUST   PASS     LICENSE
K22-REPO-02  MUST   PASS     README.md has every required section
K22-REPO-03  MUST   PASS     .gitignore, .gitattributes (LF), .editorconfig present
K22-REPO-04  MUST   PASS     gitleaks: no findings in history; no open secret-scanning alerts
K22-REPO-05  MUST   PASS     no generated executables or archives tracked
K22-REPO-06  MUST   PASS     SECURITY.md
K22-REPO-07  MUST   PASS     CONTRIBUTING.md
K22-REPO-08  MUST   PASS     .github/CODEOWNERS has a default owner
K22-REPO-09  MUST   N/A      no package manifests found
K22-REPO-10  SHOULD PASS     account-wide .github repository exists
K22-REPO-11  SHOULD PASS     README shows the Scorecard badge
K22-REPO-12  MUST   REVIEW   badge linked; verify https://www.bestpractices.dev/projects/15366 belongs to this repository, current answers and 90-day review in docs/security/best-practices.md
K22-TEST-25  MUST   REVIEW   fuzz targets and run command found; verify required PR/main gate, weekly/release budgets, properties and replay in docs/security/fuzzing.md
K22-REPO-20  MUST   PASS     protect-main complete (0 approval(s) for 1 maintainer(s))
K22-REPO-21  MUST   PASS     release tags immutable; only the maintainer creates them
K22-REPO-22  MUST   PASS     squash only, PR title/body, branches auto-deleted
K22-REPO-30  MUST   PASS     PVR, secret scanning + push protection, Dependabot alerts + updates, code scanning, immutable releases
K22-REPO-31  MUST   PASS     read-only token, no PR approvals by workflows, outside contributors need approval
K22-REPO-32  SHOULD WARN     allowed actions: all
K22-REPO-40  MUST   PASS     issues on, wiki off
K22-REPO-41  SHOULD WARN     no homepage
K22-REPO-42  MUST   PASS     listed in MAINTAINERS.md
K22-CI-01    MUST   PASS     requires 9 checks including every standard context
K22-CI-02    MUST   REVIEW   tests run on every PR and push: confirm in the language workflow
K22-CI-03    MUST   REVIEW   CI commands match CONTRIBUTING.md
K22-CI-10    MUST   PASS     10 workflow(s) start read-only
K22-CI-11    MUST   PASS     every action pinned to a commit SHA, every image to a digest
K22-CI-12    MUST   PASS     no untrusted expressions inside run: (zizmor in CI is authoritative)
K22-CI-13    MUST   PASS     no pull_request_target or workflow_run triggers
K22-CI-14    MUST   PASS     every checkout drops its credentials
K22-CI-15    MUST   PASS     release workflows use no caches
K22-CI-16    MUST   PASS     no repository-level secrets
K22-CI-17    MUST   PASS     GitHub-hosted runners only
K22-CI-18    SHOULD PASS     every job has a timeout
K22-CI-20    MUST   PASS     security.yml (secrets job)
K22-CI-21    MUST   PASS     SCA (CVEs and malicious packages) runs on changes and on a schedule
K22-CI-22    MUST   PASS     CodeQL security-extended
K22-CI-23    MUST   PASS     zizmor and actionlint run in CI
K22-CI-24    SHOULD PASS     Scorecard workflow present
K22-CI-30    MUST   PASS     releases through a SHA-pinned KofTwentyTwo/standards release-*.yml reusable workflow
K22-CI-31    MUST   REVIEW   the release workflow re-runs every main gate

N/A: 1  PASS: 33  REVIEW: 5  WARN: 2

Substantial preparation assistance: Codex (GPT-6). No release-ready, human acknowledgement, CI OIDC success or published-release status is fabricated by this checklist.

# Release checklist: v1.1.0 Prepared for the reviewed signing builder from PR #31 and its six-reference follow-up PR #39 plus the reviewed analyzer fix PR #41. Publication is authorized by the maintainer; the release must use the established Release Please proposal, its merge commit and the protected tag/environment workflow. All preflight items are complete. Post-publication asset verification remains open and is not claimed before the workflow publishes. ## 1. Conformance - [x] Live full conformance has no FAIL: 33 PASS, 1 N/A, 5 explicitly reviewed/manual items and 2 SHOULD warnings (allowed-actions scope and homepage). - [x] Applicable EX-0001 single-maintainer and EX-0006 version-bot environment exceptions are open/unexpired; no new exception is approved here. - [x] Actual Best Practices project 15366 identifies this exact standards repository and currently displays passing/100%; current assessment and next review are recorded. ## 2. Scans and findings - [x] No open HIGH/CRITICAL code-scanning alerts or Dependabot findings in the latest live API query. Existing process-only Scorecard dispositions remain explicit; no fictitious OpenVEX statement. - [x] Main's six helper-reference findings are fixed by reviewed/merged PR #39. Reviewed/merged PR #41 corrects the reproduced analyzer race without dropping any rule/test/deadline; exact main 7c44ceaa CI38274931168 and release proposal 2435f34 CI38275074089 are terminal green. - [x] No confirmed shipped vulnerability requiring OpenVEX was identified. New findings must be reassessed before tagging. ## 3. Security assessment - [x] Existing threat-model review log covers the signing extension: explicit ownership catalog, valid publisher/trust/digests/timestamps, third-party preservation, installer embedded-package hash and fail-closed publication. - [x] Changed interfaces are optional catalog inputs and protected release OIDC/Artifact Signing calls; untrusted PR code has no signing access. - [x] Primary risks: signing another publisher's files, credential access from untrusted jobs and shipping altered/unsigned package bytes. Required catalog/publisher/PE checks, protected environments, byte preservation and final distribution verification address these risks. - [x] Maintainer personally confirmed review/resolution of exact PR #31. PR #39's six references point to byte-identical reviewed helpers on signed main; its separate human confirmation was supplied. Maintainer also personally confirmed review/resolved findings for PR #41 at 1e2179a; it is merged as verified-signed 7c44ceaa. ## 4. Test depth - [x] Mutation applicability/limit recorded: no code-mutation campaign or mutation score is established for the shipped PowerShell tooling. K22-TEST-11 is a SHOULD; behavioral, property and generated-input checks below do not constitute mutation coverage. This remains an explicit assurance gap for maintainer review rather than a claim of non-applicability. - [x] Both required pre-minor parser campaigns complete with actual process exit 0: seeds 22023 and 99173, 10000 iterations and 160000 security-property assertions each; zero failures. The first earlier wrapper checked an inherited native exit value despite PASS; separate-process execution confirms the actual exit status. - [x] All 35 signing/wrapper regression tests pass, zero skips; required hosted conformance/package/security/signing tests for PR #39 pass. - [x] Representative local six-binary and final installer/portable/full-package signing integration passes actual SHA256/RFC3161/publisher/trust checks, third-party byte preservation and exact embedded-package verification. This is interactive local proof; consumer protected CI OIDC remains to be proved after publication. ## 5. Ship - [x] PR #39 and PR #41 human review confirmed, both merged; corrected main required checks are green. - [x] Release Please proposal updated to 1.1.0 at 2435f34; inspected its exact three-file version/changelog/manifest diff and all required checks passed before the authorized protected squash merge of PR #34. No new implementation was added by the version bot. Exact signed merge93b1d616 main CI38275325018 is terminal green; tag this merge commit. - [x] Preflight complete; existing explicit owner release authorization covers the maintainer release-ready label and signed tag at release PR34 merge93b1d616 with this checklist URL. Post-publication items below remain pending. - [x] Protected releaseCI38275622522 is terminal green; five actual assets downloaded, all four SHA256SUMS entries and all five provenance attestations verify. Release is immutable. Source ZIP contains exact committed version/builder/module/composite bytes at93b1d616; source bundle compiled-platform signatures/SBOM are not applicable. - [x] Published bundle inspected, archive hashes/provenance verified; close this standards checklist. MarkdownViewr adopts the published full-SHA builder in its separate signing change and must still prove its protected CI identity/final application artifacts. Evidence retained in artifacts/standards-1.1.0-93b1d61; no application release is claimed. <details><summary>Actual full conformance output</summary> ```text KofTwentyTwo conformance: KofTwentyTwo/standards (full) K22-REPO-01 MUST PASS LICENSE K22-REPO-02 MUST PASS README.md has every required section K22-REPO-03 MUST PASS .gitignore, .gitattributes (LF), .editorconfig present K22-REPO-04 MUST PASS gitleaks: no findings in history; no open secret-scanning alerts K22-REPO-05 MUST PASS no generated executables or archives tracked K22-REPO-06 MUST PASS SECURITY.md K22-REPO-07 MUST PASS CONTRIBUTING.md K22-REPO-08 MUST PASS .github/CODEOWNERS has a default owner K22-REPO-09 MUST N/A no package manifests found K22-REPO-10 SHOULD PASS account-wide .github repository exists K22-REPO-11 SHOULD PASS README shows the Scorecard badge K22-REPO-12 MUST REVIEW badge linked; verify https://www.bestpractices.dev/projects/15366 belongs to this repository, current answers and 90-day review in docs/security/best-practices.md K22-TEST-25 MUST REVIEW fuzz targets and run command found; verify required PR/main gate, weekly/release budgets, properties and replay in docs/security/fuzzing.md K22-REPO-20 MUST PASS protect-main complete (0 approval(s) for 1 maintainer(s)) K22-REPO-21 MUST PASS release tags immutable; only the maintainer creates them K22-REPO-22 MUST PASS squash only, PR title/body, branches auto-deleted K22-REPO-30 MUST PASS PVR, secret scanning + push protection, Dependabot alerts + updates, code scanning, immutable releases K22-REPO-31 MUST PASS read-only token, no PR approvals by workflows, outside contributors need approval K22-REPO-32 SHOULD WARN allowed actions: all K22-REPO-40 MUST PASS issues on, wiki off K22-REPO-41 SHOULD WARN no homepage K22-REPO-42 MUST PASS listed in MAINTAINERS.md K22-CI-01 MUST PASS requires 9 checks including every standard context K22-CI-02 MUST REVIEW tests run on every PR and push: confirm in the language workflow K22-CI-03 MUST REVIEW CI commands match CONTRIBUTING.md K22-CI-10 MUST PASS 10 workflow(s) start read-only K22-CI-11 MUST PASS every action pinned to a commit SHA, every image to a digest K22-CI-12 MUST PASS no untrusted expressions inside run: (zizmor in CI is authoritative) K22-CI-13 MUST PASS no pull_request_target or workflow_run triggers K22-CI-14 MUST PASS every checkout drops its credentials K22-CI-15 MUST PASS release workflows use no caches K22-CI-16 MUST PASS no repository-level secrets K22-CI-17 MUST PASS GitHub-hosted runners only K22-CI-18 SHOULD PASS every job has a timeout K22-CI-20 MUST PASS security.yml (secrets job) K22-CI-21 MUST PASS SCA (CVEs and malicious packages) runs on changes and on a schedule K22-CI-22 MUST PASS CodeQL security-extended K22-CI-23 MUST PASS zizmor and actionlint run in CI K22-CI-24 SHOULD PASS Scorecard workflow present K22-CI-30 MUST PASS releases through a SHA-pinned KofTwentyTwo/standards release-*.yml reusable workflow K22-CI-31 MUST REVIEW the release workflow re-runs every main gate N/A: 1 PASS: 33 REVIEW: 5 WARN: 2 ``` </details> Substantial preparation assistance: Codex (GPT-6). No release-ready, human acknowledgement, CI OIDC success or published-release status is fabricated by this checklist.
KofTwentyTwo commented 2026-10-12 16:04:03 +00:00 (Migrated from github.com)
Copy link
Copy source

The Windows-signing analyzer blocker is corrected in #41 at 1e2179a: all required hosted checks pass, including all three signing source files and 35 signing tests without skips. The same workflow body also passed 20 fresh local processes; all configured rules, versions and deadlines remain enabled. This new 23-line CI change awaits genuine maintainer review under K22-AI-01. No standards 1.1.0 or application production release has been published.

The Windows-signing analyzer blocker is corrected in #41 at 1e2179a: all required hosted checks pass, including all three signing source files and 35 signing tests without skips. The same workflow body also passed 20 fresh local processes; all configured rules, versions and deadlines remain enabled. This new 23-line CI change awaits genuine maintainer review under K22-AI-01. No standards 1.1.0 or application production release has been published.
KofTwentyTwo commented 2026-10-12 16:22:14 +00:00 (Migrated from github.com)
Copy link
Copy source

Published https://github.com/KofTwentyTwo/standards/releases/tag/v1.1.0 immutably at signed release merge93b1d616. Tagged release run38275622522 is terminal green. Actual downloaded ZIP/tar/manifest/notes match SHA256SUMS; all five release assets pass provenance verification, and ZIP builder/module/composite bytes match that exact commit. Shared-builder release work is complete. MarkdownViewr's production CI signing and application release remain separate pending work.

Published https://github.com/KofTwentyTwo/standards/releases/tag/v1.1.0 immutably at signed release merge93b1d616. Tagged release run38275622522 is terminal green. Actual downloaded ZIP/tar/manifest/notes match SHA256SUMS; all five release assets pass provenance verification, and ZIP builder/module/composite bytes match that exact commit. Shared-builder release work is complete. MarkdownViewr's production CI signing and application release remain separate pending work.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 autorelease: failed
Reserved version tag; no published release
 autorelease: pending
autorelease: tagged
breaking
Incompatible new mandatory standards; requires a MAJOR release
 bug
Something isn't working
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 release: failed
Reserved release tag failed before public publication; preserved for audit.
 release: ready
Maintainer-approved release preflight
 wontfix
This will not be worked on
No labels release: ready
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#40