You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
T09-03 Reproducible release, trusted publishing and rollback #413
Implemented by PR #509 and merged to master as 60abf8a.
Repository-side signed release and attestation support is complete: build-once exact tarball publishing, npm OIDC trusted publishing, provenance and SBOM attestations, clean-room artifact verification, release verification, and rollback planning. All available workflows on the merge commit completed successfully.
The first live npm publication remains an explicit owner-controlled external gate: claim/bootstrap the package interactively, configure npm trusted publishing for .github/workflows/publish.yml, then create the release tag. No long-lived CI publishing token was introduced.
T09-03 archive PR #510 merged to master as 96db4e8.
PR checks: all executable checks passed, including Mutation, Quality, CodeQL, Codecov patch, OSV, dependency review, workflow policy, programme drift, deterministic assurance, smoke, Node 20/22/24, strict TypeScript, SBOM, audit/secret scan, and zizmor. There were no review threads; Cursor/Copilot quota notices were non-actionable.
Post-merge workflows: CI, Pages, GitHub Programme Drift, Hardening, Push on master, Release Drafter, and Security passed.
External hosted gate: scheduled canary run 31330039614 failed closed because SUBSTACK_CANARY_CONTRACT_JSON and all alert-destination secrets are unset. Its deterministic logic check and redacted receipt upload passed. Supplying the production contract fixture and one Slack/Discord/PagerDuty secret remains owner-controlled repository configuration, not a repository-code defect.
Activity
edithatogo commentedon Aug 9, 2026
Implemented by PR #509 and merged to master as 60abf8a.
Repository-side signed release and attestation support is complete: build-once exact tarball publishing, npm OIDC trusted publishing, provenance and SBOM attestations, clean-room artifact verification, release verification, and rollback planning. All available workflows on the merge commit completed successfully.
The first live npm publication remains an explicit owner-controlled external gate: claim/bootstrap the package interactively, configure npm trusted publishing for .github/workflows/publish.yml, then create the release tag. No long-lived CI publishing token was introduced.
Archive T09-03 release provenance track (#510)
edithatogo commentedon Aug 9, 2026
T09-03 archive PR #510 merged to master as 96db4e8.
PR checks: all executable checks passed, including Mutation, Quality, CodeQL, Codecov patch, OSV, dependency review, workflow policy, programme drift, deterministic assurance, smoke, Node 20/22/24, strict TypeScript, SBOM, audit/secret scan, and zizmor. There were no review threads; Cursor/Copilot quota notices were non-actionable.
Post-merge workflows: CI, Pages, GitHub Programme Drift, Hardening, Push on master, Release Drafter, and Security passed.
External hosted gate: scheduled canary run 31330039614 failed closed because SUBSTACK_CANARY_CONTRACT_JSON and all alert-destination secrets are unset. Its deterministic logic check and redacted receipt upload passed. Supplying the production contract fixture and one Slack/Discord/PagerDuty secret remains owner-controlled repository configuration, not a repository-code defect.