Skip to content

Align release documentation with current controls #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bmurdock merged 1 commit into from
Jul 29, 2026
Merged

Align release documentation with current controls #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
# Changelog

Entries describe repository versions. A version is publicly released only after
the matching `vX.Y.Z` tag publishes to npm and a GitHub Release exists.
Entries describe repository versions. For current releases, completion requires
the matching `vX.Y.Z` tag to publish to npm and a GitHub Release to exist.
Versions `1.0.0` and `1.0.1` predate the GitHub Release record requirement;
their npm publications and Git tags remain the historical release evidence.

## 1.0.7

Expand Down
11 changes: 9 additions & 2 deletions RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,10 @@ git diff --check
The repository should enforce the following protections on `main` and any future release-bearing branches:

- require pull requests before merging
- require the `CI` workflow to pass
- require the dependency review workflow to pass for pull requests
- require every current `CI` job context: `workflow-lint`, `verify (18)`,
`verify (20)`, `verify (22)`, `verify (24)`, `verify (26)`, `browser-like`,
`browser-real`, and `package-guardrails`
- require the `dependency-review` workflow context for pull requests
- block force pushes
- block branch deletion
- require full commit SHA pins for GitHub Actions
Expand All @@ -94,6 +96,10 @@ The repository should enforce the following protections on `main` and any future
- keep the `npm` environment and npm trusted publisher configuration aligned with `.github/workflows/release.yml`
- restrict the `npm` environment to release tags matching `v*`

Update the required-context list whenever a CI matrix entry or job name
changes. A check that runs and passes but is not required does not protect
`main` from a merge that omits that evidence.

## Tag policy

Release tags should be annotated and should be signed when practical.
Expand All @@ -112,6 +118,7 @@ The npm package settings for `@gavoryn/clearfetch` should define a trusted publi
- repository: `clearfetch`
- workflow filename: `release.yml`
- environment name: `npm`
- allowed action: `npm publish`

When npm package administration is available, maintainers should also disable
traditional publish tokens. Staged publishing with a separate 2FA approval is a
Expand Down