v0.2.0 — source release

[0.2.0] - 2026-10-17

Security

• Add the explicitly labelled GitHub provider 6.13.0-openssf.1 local derivative with Go 1.27.2 and patched x/net, x/text, x/crypto and grpc dependencies. This addresses source-reachable dependency findings including GO-2026-6607 and GO-2026-6629 in the supported independent local deployment; it does not replace the official provider in existing HCP deployments.
• Document the separate, dated OpenTofu applicability assessment, strict transport checks and engine/provider integrity requirements. See the complete profile. No project CVE is assigned.

Changed

• Require one approving review while preserving stale-review dismissal, CI requirements and existing resource identities.

• Preserve existing GitHub policy during state reconciliation, keep private integration inputs protected, and manage the deployment endpoint as an Actions secret.

• Persist the EPG Actions approval policy and correct the provider import identifier for the existing endpoint secret.

• Document the verified strict Terraform/provider TLS profile and source-release scope.

• Add governance, conduct and a one-year roadmap without changing live infrastructure.

Upgrade

This is a source-only release with governance and state-management changes, not an applied infrastructure plan. Review the changes from 0.1.0 before using the configuration. Preserve the existing state and workspace bindings; import or forget only the explicitly reviewed resource identities, and inspect a fresh state-aware plan before any apply. Never apply this source against an empty replacement state. Where documented, run the review-policy reconciliation command after Terraform to preserve the additional Copilot setting. The independently patched provider profile is opt-in and does not replace the official HCP provider automatically. Keep the prior source tag and a protected state backup for rollback.

Source qualification

Channel: stable. Source 135a27e7b43333745c1b01df2fc4ff744b9b510b, tree 88e86b5edb37e219473b599a049a004f3b28f8e9. This archive contains the reviewed public tracked source only. Its bytes are identical across this beta, RC and stable cycle; channel identity is recorded in the signed tag and manifest.

• .github/workflows/quality-gate.yml: passed at the exact source revision.

Archive SHA-256: 07c4ed273dad086ec9d3bd8f7fed4deccae12f0172192a762c721b1bf1681757.

No infrastructure plan, apply, production deployment or live-system acceptance was performed by this release.

v0.2.0-rc.1 — source release

[0.2.0] - 2026-10-17

Security

• Add the explicitly labelled GitHub provider 6.13.0-openssf.1 local derivative with Go 1.27.2 and patched x/net, x/text, x/crypto and grpc dependencies. This addresses source-reachable dependency findings including GO-2026-6607 and GO-2026-6629 in the supported independent local deployment; it does not replace the official provider in existing HCP deployments.
• Document the separate, dated OpenTofu applicability assessment, strict transport checks and engine/provider integrity requirements. See the complete profile. No project CVE is assigned.

Changed

• Require one approving review while preserving stale-review dismissal, CI requirements and existing resource identities.

• Preserve existing GitHub policy during state reconciliation, keep private integration inputs protected, and manage the deployment endpoint as an Actions secret.

• Persist the EPG Actions approval policy and correct the provider import identifier for the existing endpoint secret.

• Document the verified strict Terraform/provider TLS profile and source-release scope.

• Add governance, conduct and a one-year roadmap without changing live infrastructure.

Upgrade

This is a source-only release with governance and state-management changes, not an applied infrastructure plan. Review the changes from 0.1.0 before using the configuration. Preserve the existing state and workspace bindings; import or forget only the explicitly reviewed resource identities, and inspect a fresh state-aware plan before any apply. Never apply this source against an empty replacement state. Where documented, run the review-policy reconciliation command after Terraform to preserve the additional Copilot setting. The independently patched provider profile is opt-in and does not replace the official HCP provider automatically. Keep the prior source tag and a protected state backup for rollback.

Source qualification

Channel: rc. Source 135a27e7b43333745c1b01df2fc4ff744b9b510b, tree 88e86b5edb37e219473b599a049a004f3b28f8e9. This archive contains the reviewed public tracked source only. Its bytes are identical across this beta, RC and stable cycle; channel identity is recorded in the signed tag and manifest.

• .github/workflows/quality-gate.yml: passed at the exact source revision.

Archive SHA-256: 07c4ed273dad086ec9d3bd8f7fed4deccae12f0172192a762c721b1bf1681757.

No infrastructure plan, apply, production deployment or live-system acceptance was performed by this release.

v0.2.0-beta.1 — source release

[0.2.0] - 2026-10-17

Security

• Add the explicitly labelled GitHub provider 6.13.0-openssf.1 local derivative with Go 1.27.2 and patched x/net, x/text, x/crypto and grpc dependencies. This addresses source-reachable dependency findings including GO-2026-6607 and GO-2026-6629 in the supported independent local deployment; it does not replace the official provider in existing HCP deployments.
• Document the separate, dated OpenTofu applicability assessment, strict transport checks and engine/provider integrity requirements. See the complete profile. No project CVE is assigned.

Changed

• Require one approving review while preserving stale-review dismissal, CI requirements and existing resource identities.

• Preserve existing GitHub policy during state reconciliation, keep private integration inputs protected, and manage the deployment endpoint as an Actions secret.

• Persist the EPG Actions approval policy and correct the provider import identifier for the existing endpoint secret.

• Document the verified strict Terraform/provider TLS profile and source-release scope.

• Add governance, conduct and a one-year roadmap without changing live infrastructure.

Upgrade

This is a source-only release with governance and state-management changes, not an applied infrastructure plan. Review the changes from 0.1.0 before using the configuration. Preserve the existing state and workspace bindings; import or forget only the explicitly reviewed resource identities, and inspect a fresh state-aware plan before any apply. Never apply this source against an empty replacement state. Where documented, run the review-policy reconciliation command after Terraform to preserve the additional Copilot setting. The independently patched provider profile is opt-in and does not replace the official HCP provider automatically. Keep the prior source tag and a protected state backup for rollback.

Source qualification

Channel: beta. Source 135a27e7b43333745c1b01df2fc4ff744b9b510b, tree 88e86b5edb37e219473b599a049a004f3b28f8e9. This archive contains the reviewed public tracked source only. Its bytes are identical across this beta, RC and stable cycle; channel identity is recorded in the signed tag and manifest.

• .github/workflows/quality-gate.yml: passed at the exact source revision.

Archive SHA-256: 07c4ed273dad086ec9d3bd8f7fed4deccae12f0172192a762c721b1bf1681757.

No infrastructure plan, apply, production deployment or live-system acceptance was performed by this release.

v0.1.0

Changes

• Establish the first versioned source release of the 4alvit GitHub configuration.
• Document public contribution, private vulnerability reporting, policy validation
  and the distinction between a source change and an applied infrastructure change.
• Define an explicit active public-code repository scope, two current approvals,
  stale-review dismissal, last-push approval, resolved discussions and no review
  bypass for that scope. Preserve private, archived and profile exclusions.
• Validate the public policy with an offline mocked provider and scan Terraform
  with the pinned TFLint ruleset.

Upgrade

This is Terraform source, not an applied plan or a deployment. Use the versions
and commands in CONTRIBUTING.md, preserve the existing state/workspace bindings,
and review the real state-aware plan before applying. Never initialize an empty
state to apply this configuration to existing infrastructure. When importing
existing rules, use their actual IDs and retain unrelated repository settings.

Security

The release adds source policy for secret scanning, push protection and private
vulnerability reporting, and strengthens public repository review requirements.
A source release does not assert that every remote rule has already been applied.
No project CVE is assigned to this release. See SECURITY.md for confidential reports.

Validation

The release source tree is identical to PR #58 head 389b0b0fa1bf29fdc8c725f65b1cf3b16310a66f. Required CI validation and CodeQL passed before the merge. Download the GitHub source archive for this tag; this release contains no prebuilt runtime package.