diff --git a/.github/workflows/commit-messages.yml b/.github/workflows/commit-messages.yml index 9621a61..fe51ba9 100644 --- a/.github/workflows/commit-messages.yml +++ b/.github/workflows/commit-messages.yml @@ -11,6 +11,7 @@ permissions: jobs: check: + name: Commit messages runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/README.md b/README.md index 617214f..ac5c2cd 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ Reviewers treat repeated semantic values—such as versions, runners, paths, and SHAs—as possible duplication or drift smells. Centralization is recommended only when the values should change together and the trade-off improves clarity. -**Compatibility status:** The current published source (`6b279b3`, checked +**Compatibility status:** The immutable `v1.0.0` tag (`6b279b3`, checked 2026-10-13) passed the copied-package smoke matrix for Codex and Claude Code with Skills CLI 1.7.2. Hermes external-directory setup is documented but not part of the verification matrix. diff --git a/SECURITY.md b/SECURITY.md index 1cbe28c..a4a6004 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,7 +6,8 @@ Report security vulnerabilities via [GitHub Security Advisories](https://github. ## Supported Versions -Only the latest release on the `main` branch receives security updates. +Only the latest immutable release tag and the current `main` branch receive +security updates. ## Repo-Specific Concerns diff --git a/docs/release-checklist.md b/docs/release-checklist.md index 0b1be70..401bc9e 100644 --- a/docs/release-checklist.md +++ b/docs/release-checklist.md @@ -18,8 +18,11 @@ checks that cannot be meaningfully run against the local source tree. published-package check below. 4. Do not add a skill self-version, version-consistency gate, or release automation at the current maintenance scale. -5. GitHub Releases and semver tags are not required. Add an immutable tag only - when consumers need a stable, machine-addressable release point. +5. Keep releases event-driven. After a runtime-payload change passes this + checklist, create one annotated immutable semver tag: major for a breaking + scope/routing removal, minor for a backward-compatible workflow expansion, + or patch for a compatible correction. Do not tag documentation-only or + CI-only changes. GitHub Releases are not required. 6. Before release, review repeated semantic values (versions, runners, OS names, paths, SHAs, ports, and feature flags) as possible duplication/drift @@ -53,6 +56,12 @@ source or the payload being checked. - [x] The commit bodies on `main` use `what:`/`why:` and the detailed rationale remains in commits and research/decision notes; no `CHANGELOG.md` exists. +## Immutable consumer releases + +- [x] `v1.0.0` is an annotated tag at `6b279b3`, the payload commit validated + by the 2026-10-13 Codex and Claude Code smoke matrix. It does not have a + GitHub Release or changelog. + ## Published-package smoke matrix Run each row from a separate empty temporary directory. The commands use diff --git a/docs/research.md b/docs/research.md index 08cfd1d..eedc7ee 100644 --- a/docs/research.md +++ b/docs/research.md @@ -599,10 +599,13 @@ needs independent discovery, different tools, or a large body of guidance. **Decision (revised 2026-10-13):** Record notable changes in the git commit history (`what:`/`why:` commit bodies) while publishing from `main`; do not keep -a `CHANGELOG.md` and do not require GitHub Releases or semver tags. History and -per-phase progress live in the git log and `docs/roadmap.md`, not a changelog -file. Prior `CHANGELOG.md` entries were folded into this model on 2026-10-13. -`SKILL.md` declares no skill self-version (no top-level `version:`; +a `CHANGELOG.md`, GitHub Releases, or a calendar release cadence. `v1.0.0` is +an annotated immutable consumer-release tag for the validated payload at +`6b279b3`. Create a later semver tag only for a release-worthy runtime-payload +change after the checklist passes, not for documentation-only or CI-only work. +History and per-phase progress live in the git log and `docs/roadmap.md`, not a +changelog file. Prior `CHANGELOG.md` entries were folded into this model on +2026-10-13. `SKILL.md` declares no skill self-version (no top-level `version:`; `metadata.version` stays the pinned Zola tool version, not a skill release). **Rationale:** The 2026-09-03 skill-repo git-polish survey (study note @@ -617,7 +620,7 @@ had accepted. The repository therefore uses the conservative `metadata.compatibility` shape, while `metadata.version` stays an opaque custom key for the pinned Zola tool version. -**Revisit when:** a consumer needs an immutable, machine-readable release point +**Revisit when:** a release tag fails to provide sufficient consumer stability, or the repository grows a multi-maintainer release process. ## External skill evidence — jim60105/blog `blog-post` (2026-09-05) diff --git a/docs/roadmap.md b/docs/roadmap.md index 1fc5276..212a2e4 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -81,10 +81,15 @@ full terms are in [`LICENSE`](../LICENSE), and `skills/zola/SKILL.md` declares Publish changes from `main` and record notable updates in the git commit history (`what:`/`why:` commit bodies); do not keep a `CHANGELOG.md` and do not -require GitHub Releases or semver tags. Do not add a `version` field to -`SKILL.md` frontmatter. Tags `phase-1`..`phase-5` are historical roadmap -milestones; the validation runner's pinned Zola version is the tool version the -skill is validated against and is independent of a skill release identity. +require GitHub Releases or a calendar release cadence. `v1.0.0` is the first +immutable consumer-release tag. Create another semver tag only after a payload +change that has passed the release checklist: increment major for a breaking +scope/routing removal, minor for a backward-compatible workflow expansion, and +patch for a compatible correction. Do not tag documentation-only or CI-only +changes. Do not add a `version` field to `SKILL.md` frontmatter. Tags +`phase-1`..`phase-5` are historical roadmap milestones; the validation runner's +pinned Zola version is the tool version the skill is validated against and is +independent of a skill release identity. The `Commit messages` workflow checks the commit-message contract on pull requests and pushes to `main`. Fixture, structural, and published-package diff --git a/docs/vision.md b/docs/vision.md index 68eaa70..3339ba9 100644 --- a/docs/vision.md +++ b/docs/vision.md @@ -78,7 +78,9 @@ terms are present in the repository. Changes are published from `main` and recorded in the git commit history (`what:`/`why:` commit bodies), which the commit-message workflow verifies on pull requests and pushes to `main`; this repository keeps no `CHANGELOG.md` and does not require GitHub Releases or -semver tags. `SKILL.md` declares no skill self-version, and +semver tags on a calendar. The immutable `v1.0.0` tag identifies the first +consumer release; future tags are event-driven release records, not a cadence. +`SKILL.md` declares no skill self-version, and `metadata.version` is the pinned Zola tool version the skill is validated against, not a skill release number.