Skip to content

Document repository hardening follow-up #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sergeliatko merged 1 commit into from
Jul 27, 2026
Merged

Document repository hardening follow-up #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

## [Unreleased]

- Document private vulnerability reporting and immutable annotated template tag handling.

## [v1.4.0]

- Make generated releases deterministic across operating systems, verify staged and archived bytes, guard immutable tags and drafts, and add a final-tree preflight.
Expand Down
4 changes: 3 additions & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,9 @@ The `main` branch receives security fixes.

Do not open a public issue for private intake exposure, credential leaks, release artifact contamination, or workflow security concerns.

Report security concerns through TechSpokes: [www.techspokes.com](https://www.techspokes.com).
Use [GitHub private vulnerability reporting](https://github.com/TechSpokes/skill-base-template/security/advisories/new) to send the repository maintainers a confidential report.

Use the [TechSpokes contact route](https://www.techspokes.com) if GitHub private vulnerability reporting is unavailable.

## Sensitive Material

Expand Down
11 changes: 9 additions & 2 deletions docs/TEMPLATE-RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,11 @@ All changes reach `main` through a branch and a pull request. Do not push direct

Open a branch, make the change, and open a pull request. The required check `Validate template scaffold` must pass on a branch that is up to date with `main`. Merge with a squash so history stays linear.

Cut the release only after the change is merged. Bump the version, then push the `vX.Y.Z` tag. Pushing a tag is not a push to the protected branch, so the ruleset allows it.
Cut the release only after the change is merged. Confirm that the version identity is unused, create an annotated `vX.Y.Z` tag at the validated `main` commit, then push the tag.

The active `Protect version tags` ruleset allows new version tags but prevents updates and deletions. Correct a release mistake with a new version instead of moving or deleting an existing version tag.

Sign new annotated tags when the maintainer signing path is deliberately configured. Never replace an existing tag merely to add a signature.

## Release Checklist

Expand All @@ -26,7 +30,10 @@ Cut the release only after the change is merged. Bump the version, then push the
- Add `docs/releases/vX.Y.Z.md`.
- Run `npm run validate`.
- Run `npm run package -- vX.Y.Z` as a local smoke test when packaging changes need verification.
- Tag the release with `vX.Y.Z`.
- Confirm that the remote tag and GitHub Release for `vX.Y.Z` do not exist.
- Create an annotated `vX.Y.Z` tag at the validated `main` commit.
- Push the tag and wait for the draft-release workflow to pass.
- Review and publish the source-only draft release.

## GitHub Draft Release

Expand Down