docs: add Action security policy and changelog

CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.0.0] - Unreleased
+
+### Added
+
+- Initial public release of SemaFore for GitHub Actions.
+- Notify mode with recipient resolution and per-device X3DH/Double Ratchet
+  encryption before delivery through the ADR-0166 integration API.
+- Execute mode with `create_thread`, `archive_thread`, and `audit_event` actions.
+- Bootstrap Action for one-time device registration, local key generation, and
+  encrypted writeback to GitHub Actions secrets.
+- Sensitive-input origin and placeholder checks, log masking, bounded HTTP
+  timeouts, and retries for safe transient failures.
+- GitHub repository-secret helper with public-key fetch, libsodium sealed-box
+  encryption, and create-or-update support.
+- Bundled `dist/` runtime containing `@attomus/semafore-crypto` v1.0.1 inline.
+- CI verification for linting, type-checking, tests, bundle freshness,
+  dependency audit, and secret scanning.
+
+### Security
+
+- Notification content is end-to-end encrypted in the GitHub runner for each
+  recipient device using X3DH and Double Ratchet; SemaFore routes ciphertext
+  envelopes and cannot read the notification content.
+- Bootstrap private-key material is generated in the runner and sealed to
+  GitHub's repository public key before upload.
+- The committed runtime bundle is excluded from duplicate gitleaks inspection;
+  its source and the remainder of the full Git history remain scanned.
+
+### Dependencies
+
+- Runtime dependency on `@attomus/semafore-crypto` `^1.0.0`.
+
+[Unreleased]: https://github.com/Attomus/semafore-github-action/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/Attomus/semafore-github-action/releases/tag/v1.0.0

README.md

@@ -122,6 +122,7 @@ the `SEMAFORE_GITHUB_SECRET_TOKEN` repository secret.
 
 Tagged `v1.x.x` releases will become Marketplace versions once the Action is
 ready. The floating `v1` tag will point to the latest compatible v1 release.
+Release history is recorded in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Responsible Disclosure
 

SECURITY.md

@@ -1,6 +1,47 @@
 # Security Policy
 
-Please report suspected vulnerabilities privately to `security@attomus.com`.
+## Reporting Security Issues
 
-Do not open public issues for vulnerabilities, secrets, private keys, token
-material, or workflow configurations that could expose a customer environment.
+Report suspected vulnerabilities privately to `security@attomus.com`. You can
+also use a private vulnerability report from this repository's **Security** tab.
+
+Please include reproduction steps, the affected version, the expected impact,
+and any relevant workflow excerpts, test vectors, or wire bytes. Do not include
+real credentials, tokens, private keys, or customer data, and do not open a
+public issue for a suspected vulnerability.
+
+## Supported Versions
+
+| Version | Supported |
+| --- | --- |
+| 1.x | Yes |
+| Pre-release versions earlier than 1.0.0 | No |
+
+Security fixes are made against the latest compatible v1 release. Users should
+follow the floating `v1` tag or update to the latest `v1.x.x` tag.
+
+## Scope
+
+In scope:
+
+- the Action and bootstrap Action code in this repository;
+- the `@attomus/semafore-crypto` code bundled into `dist/`;
+- handling of service tokens, device keys, and bootstrap key material; and
+- the encrypted notification and execute wire formats emitted by the Action.
+
+Out of scope:
+
+- vulnerabilities in GitHub Actions or a reporter's own workflow configuration
+  that are not caused by this Action;
+- general SemaFore product or infrastructure issues, which should be reported
+  through the [main SemaFore disclosure policy](https://attomus.com/security/);
+  and
+- vulnerabilities in third-party dependencies that do not arise from how this
+  Action uses them, which should be reported to the upstream maintainer.
+
+## Response Commitment
+
+Attomus aims to acknowledge reports within 48 hours and provide an initial
+assessment, including severity and an expected remediation timeline, within
+7 days. We will coordinate a fix and disclosure date with the reporter
+before details are made public.