diff --git a/.github/badges/conformance.svg b/.github/badges/conformance.svg index 374f759..2b58cc0 100644 --- a/.github/badges/conformance.svg +++ b/.github/badges/conformance.svg @@ -1,10 +1,10 @@ - - trsdn standard: v1.15.0 - Healthy + + trsdn standard: v1.21.0 - Healthy trsdn standard - v1.15.0 - Healthy + v1.21.0 - Healthy diff --git a/.github/conformance.yml b/.github/conformance.yml index 9fd1062..7aef5b1 100644 --- a/.github/conformance.yml +++ b/.github/conformance.yml @@ -4,8 +4,8 @@ # Criteria: https://github.com/trsdn/.github/blob/main/docs/repository-quality-standard.md # Evidence: docs/self-assessment.md (only for results that aren't a clean pass) -standard_version: "1.15.0" -assessed_on: "2026-09-20" +standard_version: "1.21.0" +assessed_on: "2026-09-22" state: "Healthy" evidence: "docs/self-assessment.md" @@ -37,6 +37,8 @@ criteria: P09: pass P10: pass P11: pass + P12: pass + P13: pass S01: pass S02: pass S03: pass @@ -64,6 +66,7 @@ criteria: R06: pass R07: pass R08: pass + R09: pass I01: pass I02: pass I03: pass diff --git a/docs/self-assessment.md b/docs/self-assessment.md index a710c8b..b6934d9 100644 --- a/docs/self-assessment.md +++ b/docs/self-assessment.md @@ -2,8 +2,8 @@ Assessed against the [trsdn Repository Quality Standard](https://github.com/trsdn/.github/blob/main/docs/repository-quality-standard.md) -v1.15.0 on 2026-09-20, by an AI agent reading the repository, the GitHub API and -the published v1.3.0 release. The machine-readable result is +v1.21.0 on 2026-09-22, by an AI agent reading the repository, the GitHub API and +the published v1.3.2 release. The machine-readable result is [`.github/conformance.yml`](../.github/conformance.yml); this document is the evidence for every criterion that isn't a clean pass. A clean pass isn't repeated here — see `standard.yml`'s catalog for what each ID means. @@ -15,15 +15,38 @@ Overall state: **Healthy**: no criterion is `Fail` and none is `Partial`. Baseline, Public, Software, Package And Release, Product Identity, Agent Readiness, Language And Localization, Accessibility, Data Protection And Privacy, and Published Site. OpenPromptr ships a product (a signed macOS app) -to an audience that never needs to open the repository, which is what -triggers Published Site under -[decision 0009](https://github.com/trsdn/.github/blob/main/docs/decisions/0009-published-sites-and-content-boundaries.md) -even though this isn't a "site repo" in the usual sense. +that a non-developer installs and runs by name, which is what triggers +Published Site under the standard's +["Published Sites"](https://github.com/trsdn/.github/blob/main/docs/repository-quality-standard.md#published-sites) +section and +[decision 0020](https://github.com/trsdn/.github/blob/main/docs/decisions/0020-public-applications-need-a-site.md): +that profile now applies whether or not a site exists yet, and OpenPromptr +already publishes one at `docs/`, served by GitHub Pages. Not claimed: Documentation (the primary product is the app, not documentation or content), Deployable (a distributed desktop app, not a deployed service), Archived (the repository is active). +## New since the 1.15.0 record + +- **P12** — pass. Both Dependabot alerts and Dependabot security updates are + enabled (`gh api repos/trsdn/OpenPromptr/vulnerability-alerts` and + `.../automated-security-fixes`, both `204`). +- **P13** — pass. A CodeQL default setup is configured and its state is + `active` (confirmed by `scripts/assess.py` and + `gh api repos/trsdn/OpenPromptr/code-scanning/default-setup`), covering + Swift, JavaScript/TypeScript and GitHub Actions. The `CodeQL` check on the + latest runs of `main` is green. +- **R09** — pass. `RELEASE_CHECKLIST.md` now documents the release security + gate (a new step 5) and a "Release security gate log" table, on the same + convention as the existing smoke-test log. Both parts read the checks this + repository already runs continuously: GitHub secret scanning (`S05`) and + Dependabot alerts (`P12`). At assessment time, both are empty for `main` + (`gh api repos/trsdn/OpenPromptr/secret-scanning/alerts?state=open` and + `.../dependabot/alerts?state=open` with `severity=critical`/`high`), and the + log records that retroactively for the latest release, `v1.3.2` + (commit `649471a`). + ## Resolved since the last pass - **R03–R08** — `v1.2.0` and `v1.3.0` are real, signed, notarized releases @@ -124,3 +147,10 @@ Archived (the repository is active). or a physical keyboard walkthrough. - **W01** — "repeatable, documented process" here is simply: GitHub Pages serves `docs/` from `main` directly, no build step and no vendored assets. + GitHub's own automatic `pages build and deployment` run for the latest + commit (`1cca2e1`, 2026-09-21T21:10) failed with a transient `403` uploading + the Pages artifact; the run before it succeeded and the site is live and + serving the previous commit's content. This is a platform-side hiccup in a + workflow the repository does not own or configure, not a defect in the + publishing process itself, and it needs no fix here beyond a retry (a push, + or `gh workflow run`) whenever the next commit lands.