From eafb02092bed1d9792b5a195470926a6dec2201c Mon Sep 17 00:00:00 2001 From: sergeliatko Date: Mon, 27 Jul 2026 16:58:40 +0200 Subject: [PATCH] document repository hardening follow-up --- CHANGELOG.md | 2 ++ SECURITY.md | 4 +++- docs/TEMPLATE-RELEASING.md | 11 +++++++++-- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 19b066b..e4bd04e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## [Unreleased] +- Document private vulnerability reporting and immutable annotated template tag handling. + ## [v1.4.0] - Make generated releases deterministic across operating systems, verify staged and archived bytes, guard immutable tags and drafts, and add a final-tree preflight. diff --git a/SECURITY.md b/SECURITY.md index a5b481c..537707d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,7 +8,9 @@ The `main` branch receives security fixes. Do not open a public issue for private intake exposure, credential leaks, release artifact contamination, or workflow security concerns. -Report security concerns through TechSpokes: [www.techspokes.com](https://www.techspokes.com). +Use [GitHub private vulnerability reporting](https://github.com/TechSpokes/skill-base-template/security/advisories/new) to send the repository maintainers a confidential report. + +Use the [TechSpokes contact route](https://www.techspokes.com) if GitHub private vulnerability reporting is unavailable. ## Sensitive Material diff --git a/docs/TEMPLATE-RELEASING.md b/docs/TEMPLATE-RELEASING.md index ecfc775..c64831b 100644 --- a/docs/TEMPLATE-RELEASING.md +++ b/docs/TEMPLATE-RELEASING.md @@ -16,7 +16,11 @@ All changes reach `main` through a branch and a pull request. Do not push direct Open a branch, make the change, and open a pull request. The required check `Validate template scaffold` must pass on a branch that is up to date with `main`. Merge with a squash so history stays linear. -Cut the release only after the change is merged. Bump the version, then push the `vX.Y.Z` tag. Pushing a tag is not a push to the protected branch, so the ruleset allows it. +Cut the release only after the change is merged. Confirm that the version identity is unused, create an annotated `vX.Y.Z` tag at the validated `main` commit, then push the tag. + +The active `Protect version tags` ruleset allows new version tags but prevents updates and deletions. Correct a release mistake with a new version instead of moving or deleting an existing version tag. + +Sign new annotated tags when the maintainer signing path is deliberately configured. Never replace an existing tag merely to add a signature. ## Release Checklist @@ -26,7 +30,10 @@ Cut the release only after the change is merged. Bump the version, then push the - Add `docs/releases/vX.Y.Z.md`. - Run `npm run validate`. - Run `npm run package -- vX.Y.Z` as a local smoke test when packaging changes need verification. -- Tag the release with `vX.Y.Z`. +- Confirm that the remote tag and GitHub Release for `vX.Y.Z` do not exist. +- Create an annotated `vX.Y.Z` tag at the validated `main` commit. +- Push the tag and wait for the draft-release workflow to pass. +- Review and publish the source-only draft release. ## GitHub Draft Release