chore(release): prepare Registry Stack v0.12.0 beta-14

.github/workflows/ci.yml

@@ -18,6 +18,8 @@ env:
   CARGO_LLVM_COV_VERSION: "0.8.7"
   GITLEAKS_VERSION: "8.30.1"
   GITLEAKS_LINUX_X64_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+  OASDIFF_VERSION: "1.23.0"
+  OASDIFF_LINUX_X64_SHA256: "972b10535c3db4366b9dc3ebc11ca021279af3095267c3cffdca854a3a3c4f89"
 
 jobs:
   changes:
@@ -341,6 +343,19 @@ jobs:
         with:
           tool: cargo-deny@0.19.8,just@1.51.0
 
+      - name: Install pinned oasdiff
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "${RUNNER_TEMP}/bin"
+          curl --fail --silent --show-error --location \
+            --output "${RUNNER_TEMP}/oasdiff.tar.gz" \
+            "https://github.com/oasdiff/oasdiff/releases/download/v${OASDIFF_VERSION}/oasdiff_${OASDIFF_VERSION}_linux_amd64.tar.gz"
+          echo "${OASDIFF_LINUX_X64_SHA256}  ${RUNNER_TEMP}/oasdiff.tar.gz" | sha256sum -c -
+          tar -xzf "${RUNNER_TEMP}/oasdiff.tar.gz" -C "${RUNNER_TEMP}/bin" oasdiff
+          chmod +x "${RUNNER_TEMP}/bin/oasdiff"
+          echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
+
       - name: Cargo metadata
         run: cargo metadata --locked --format-version 1 >/tmp/registry-stack-cargo-metadata.json
 

CONTRIBUTING.md

@@ -145,7 +145,7 @@ These checks require Python 3.11 or later.
 ```bash
 python3 -m unittest release/scripts/test_registry_release.py
 python3 -m unittest release/scripts/test_openid_conformance_runner.py
-release/scripts/registry-release validate release/manifests/registry-stack-beta-13.yaml
+release/scripts/registry-release validate release/manifests/registry-stack-beta-14.yaml
 release/scripts/registry-release audit release/manifests/import-map-2026-06-24.yaml
 REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
 python3 -m unittest release/scripts/test_check_release_source_model.py

Cargo.toml

@@ -40,7 +40,7 @@ exclude = [
 resolver = "2"
 
 [workspace.package]
-version = "0.11.0"
+version = "0.12.0"
 edition = "2021"
 rust-version = "1.95"
 license = "Apache-2.0"
@@ -51,29 +51,29 @@ repository = "https://github.com/registrystack/registry-stack"
 unsafe_code = "forbid"
 
 [workspace.dependencies]
-registry-config-report = { path = "crates/registry-config-report", version = "0.11.0" }
-registry-language-server = { path = "crates/registry-language-server", version = "0.11.0" }
-registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.11.0" }
-registry-notary-client = { path = "crates/registry-notary-client", version = "0.11.0" }
-registry-notary-core = { path = "crates/registry-notary-core", version = "0.11.0" }
-registry-relay = { path = "crates/registry-relay", version = "0.11.0" }
-registry-notary-server = { path = "crates/registry-notary-server", version = "0.11.0", default-features = false }
-registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.11.0" }
-registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.11.0" }
-registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.11.0" }
-registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.11.0" }
-registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.11.0" }
-registry-platform-config = { path = "crates/registry-platform-config", version = "0.11.0" }
-registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.11.0" }
-registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.11.0" }
-registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.11.0" }
-registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.11.0" }
-registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.11.0" }
-registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.11.0" }
-registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.11.0" }
-registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.11.0" }
-registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.11.0" }
-registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.11.0" }
+registry-config-report = { path = "crates/registry-config-report", version = "0.12.0" }
+registry-language-server = { path = "crates/registry-language-server", version = "0.12.0" }
+registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.12.0" }
+registry-notary-client = { path = "crates/registry-notary-client", version = "0.12.0" }
+registry-notary-core = { path = "crates/registry-notary-core", version = "0.12.0" }
+registry-relay = { path = "crates/registry-relay", version = "0.12.0" }
+registry-notary-server = { path = "crates/registry-notary-server", version = "0.12.0", default-features = false }
+registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.12.0" }
+registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.12.0" }
+registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.12.0" }
+registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.12.0" }
+registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.12.0" }
+registry-platform-config = { path = "crates/registry-platform-config", version = "0.12.0" }
+registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.12.0" }
+registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.12.0" }
+registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.12.0" }
+registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.12.0" }
+registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.12.0" }
+registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.12.0" }
+registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.12.0" }
+registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.12.0" }
+registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.12.0" }
+registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.12.0" }
 
 crosswalk-core = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }
 crosswalk-functions = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }

SECURITY.md

@@ -44,14 +44,14 @@ include cosign signatures without SLSA provenance.
 
 For each signed release asset, download three files from the GitHub Release:
 
-- The asset, for example `registryctl-v0.11.0-linux-amd64`
-- The matching signature, for example `registryctl-v0.11.0-linux-amd64.sig`
-- The matching certificate, for example `registryctl-v0.11.0-linux-amd64.pem`
+- The asset, for example `registryctl-v0.12.0-linux-amd64`
+- The matching signature, for example `registryctl-v0.12.0-linux-amd64.sig`
+- The matching certificate, for example `registryctl-v0.12.0-linux-amd64.pem`
 
 Then verify the asset:
 
 ```bash
-asset=registryctl-v0.11.0-linux-amd64
+asset=registryctl-v0.12.0-linux-amd64
 
 cosign verify-blob \
   --certificate "${asset}.pem" \
@@ -69,7 +69,7 @@ For releases with SLSA provenance, download the provenance asset and verify the
 artifact against the release tag:
 
 ```bash
-tag=v0.11.0
+tag=v0.12.0
 asset=registryctl-${tag}-linux-amd64
 provenance=registry-stack-${tag}-release-provenance.intoto.jsonl
 

crates/registry-relay/CHANGELOG.md

@@ -2,11 +2,18 @@
 
 ## Unreleased
 
+## 0.12.0 - 2026-07-19
+
 - Align the 1.0 standards roster with the canonical no-optional-feature release
   build. OpenAPI and problem contracts, portable metadata, CSV and XLSX input,
   and JSON aggregate output are stable. Optional standards adapters and the
   shipped non-gated Parquet, CSV aggregate, and SDMX-JSON surfaces are
   experimental and feature-frozen, outside the 1.0 compatibility promise.
+- Surface protected per-resource last-good refresh health through Prometheus
+  metrics and restricted admin posture without failing readiness while a valid
+  last-good table remains available.
+- Move maintained Relay runtime images and the release image to Debian 13 and
+  enforce the matching image-base and vulnerability policy in release gates.
 
 ## 0.11.0 - 2026-07-18
 

crates/registry-relay/docs/release-notes.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## 0.12.0
+
 - Relay now surfaces per-resource last-good refresh health through protected
   Prometheus gauges and restricted admin posture. Failed refreshes preserve a
   valid last-good table and `/ready` remains healthy, while consecutive failure
@@ -14,6 +16,8 @@
   excluded from the canonical release binary while their source and all-feature
   tests remain available. Non-feature-gated experimental formats remain shipped
   but outside the 1.0 compatibility promise.
+- Maintained Relay runtime images now use Debian 13. Release checks enforce the
+  expected base and vulnerability policy before publication.
 
 ## 0.11.0