v1.8.1 — Founding contributors, release-infra hygiene, ribbon and voice polish

Index of changes

Added

• Founding contributors section on /about.html (Item A of the founding-cohort brainstorm). New <section id="founding"> between Leadership and FAQ lists the 52 researchers across 21 countries who participated in COST Open Call OC-2024-1-27931 establishing this Action. Sourced from a new data/founding-proposers.json (the JSON also records membership status, MC-availability at founding, and the original source name where the affiliation needed light cleanup). Renders runtime via inline JS; reuses the existing country-grid / mc-collapse / mc-stats patterns from the MC country grid directly above so the founding cohort reads as a parallel "where we came from" narrative to the current MC composition. FR + DE variants land alongside, with locale-aware country names and the corresponding "Soumissionnaire" / "Antragsteller" badge for the Open Call Proposer (Dr Hugo Meijer). Privacy notice on /privacy.html (+ FR + DE) gains a new sub-section under §2 documenting the founding-listing as a separate processing activity with Article 6 (1)(f) legitimate-interest basis and a fourteen-day contact-form opt-out. Pairs with the Wiki-side directory-growth tracker (Item B) and a follow-up issue covering Items C (per-bio "founding contributor" badge) and D (founding-cohort stats refresh on press kit + PDF documentation pack). #242.
• Three new entries in data/events.json from the official Action event ledger: the NetSec Policy Workshop (4 September 2026, format TBC), the NetSec ITC Conference (8–11 September 2026, ITC Conference Grant scheme), and the Inaugural Management Committee plenary (18 September 2026, the firm date previously listed as "before late September"). Each entry feeds the home-page event banner via data/events.json and the public webcal feed via calendar.ics; calendar.ics rebuilt accordingly (5 events). Public roadmap (/roadmap.html + FR + DE) firms up the MC-plenary card date from "Before late September 2026" / "Avant fin septembre 2026" / "Vor Ende September 2026" to 18 September / 18 septembre / 18. September. docs/roadmap-2026.md timeline gets matching rows for the Policy workshop and the ITC Conference between the existing Stockholm and MC plenary entries. Past Core Group JourFix dates (January, March, May 2026) and the September Core Group + MC back-to-back are seeded into the Wiki Meetings index (Wiki commit; minutes pending). #244.
• Issue-lifecycle automation (#238 item C). Three new workflows under .github/workflows/ bound the open-issue backlog without manual sweeping: lock-closed-issues.yml (daily 13:00 UTC) locks issues 14+ days after closure to keep drive-by comments off settled threads, issue-lifecycle-comment.yml (on labeled event) auto-posts the standard message when a lifecycle label lands (needs-info, duplicate, wontfix, stale), and issue-sweep.yml (daily 14:00 UTC) labels open issues stale after 60 days of inactivity, closes stale issues after another 14 days, and closes needs-info issues if no human comment arrives within 14 days. Two new labels (needs-info, stale) join the existing bug, enhancement, documentation, duplicate, wontfix set. Thresholds tuned softer than the upstream anthropics/claude-code defaults (14 / 60 / 14 vs. their 7 / 30 / 7) because our backlog is small and the maintainer reads every notification by hand. Label vocabulary + workflow behaviour codified in CLAUDE.md §12. #240.
• YAML-form GitHub issue templates (#238 item B). Three structured forms land under .github/ISSUE_TEMPLATE/: bug_report.yml (preflight checkboxes + required actual / expected / repro / environment), enhancement.yml (mirrors the maintainer's What's happening / Why it matters / Fix path / Target shape from CLAUDE.md §3), documentation.yml (typed dropdown picking which surface the issue affects: maintainer docs, Wiki, PDF pack, public copy, cross-cutting). A config.yml disables blank issues and routes routine questions to the public contact form, the FAQ, the Wiki onboarding page, and the ESSC 2026 member orientation. CLAUDE.md §3 updated to point external contributors at the forms while keeping the four-section maintainer-issue shape as the canonical body content for gh issue create paths. #239.
• CLAUDE.md §12 Release-infrastructure hygiene (#238). Codifies the three conventions on .github/ introduced across items A, B, and C of the issue: SHA-pin third-party actions with tag-comment annotation, YAML-form issue templates rather than free-form markdown, and the lifecycle-label vocabulary table (needs-info, stale, duplicate, wontfix). Lands together so the next maintainer inherits the conventions rather than rederiving them from upstream.

Changed

• Home-page event cards (index.html + FR + DE) refreshed against the official Action event ledger. Two new cards added between the European Security Conference and the Inaugural MC Plenary: the NetSec Policy Workshop (4 September 2026) and the NetSec ITC Conference (8–11 September 2026, ITC Conference Grant scheme; travel-grant support linked through to grants.html). The Inaugural Management Committee Plenary card firms up from "To be announced" to 18 September 2026 with updated body prose (first formal plenary, MC representatives + Working Group leads, restricted-access notice; the previous Kick-off Meeting event-type pill becomes MC Plenary). The Summer School card updates the Application deadline meta row to Applications closed on 1 March 2026. Selected participants will be contacted by the scientific coordinators; the CTA text shortens from Full details & how to apply to Full details since applications have closed. The event-list now matches the chronological order in data/events.json (Summer School → ESSC → Policy Workshop → ITC Conference → MC Plenary). The home-page cards are still hand-coded HTML rather than rendered from events.json; deriving them at build time is tracked in #249 for v1.9.0. #248.
• .github/workflows/*.yml third-party actions SHA-pinned with tag-comment annotation (#238 item A). Every uses: line across the eleven touched workflow files now references a commit SHA instead of a floating version tag, with a trailing # vN (sha-pinned) comment for human readability. Closes the supply-chain exposure where a maintainer of any third-party action (or an attacker who compromises one) could push a malicious commit under the same tag and run with contents: write plus pull-requests: write on our next sync. Affected: actions/checkout@v4, actions/configure-pages@v5, actions/deploy-pages@v4, actions/setup-node@v4, actions/setup-python@v5, actions/upload-pages-artifact@v3, peter-evans/create-pull-request@v7. Widens the scope of #151 (which only covered Node 20 removal pinning) to the full third-party surface. Dependabot continues to surface updates via PR, updating the SHA explicitly each time. #239.
• scripts/sync-cost.py now propagates per-bio WG memberships from cost.eu into data/bios.json (#236 Gap A). The weekly Monday sync (plus any manual workflow_dispatch) parses the Membership table on https://www.cost.eu/actions/CA24154/, looks each row up against bios.json.members[].name via the existing norm() helper, and overwrites the matched entry's wgs field with cost.eu's list. Entries not present on cost.eu (community members in the directory who aren't on the MC, or seed entries for leaders not yet on the Membership table) are left untouched. Before this change, the home-page WG chips (driven by WG_MAP in index.html) and the /people.html per-bio chips (driven by the Google Form submitter's answer) could drift indefinitely. cost.eu is now the authoritative source for formal WG membership on both surfaces; the Google Form remains the seed when a bio first lands. Rule documented in docs/bios-setup.md. Six new smoke tests in scripts/test-sync-cost.py cover the overwrite, idempotency, leave-unmatched-alone, salutation normalisation, missing-file, and leadership-suffix regression cases. Gaps B (statistics + country roster) and C (leadership-label regex holes) deferred to v1.10.0. #237.
• Public roadmap (roadmap.html + FR + DE) and docs/roadmap-2026.md reshuffled around the Stockholm conference cadence. Five planned releases now interleave with the Action calendar: v1.8.1 (28 May, this release), v1.9.0 (5 June, pre-Stockholm calendar plumbing), v1.10.0 (late July, reactive post-conference patch with sync-cost Gaps B + C, Stockholm recap, FR / DE FAQ + Glossary native-speaker pass), v1.11.0 (mid September, three days ahead of the inaugural MC plenary; Outputs section refresh with D6 cards + schema.org/ScholarlyArticle, Phase 2 IA pass, founding-cohort follow-ups #245, PDF documentation pack section-level catch-up #229), v1.12.0 (late December, Year 1 retrospective + D11 + D12 + per-page OG images + FAQ / Glossary print stylesheet + member-photos-out-of-git refactor #119). August is a deliberate break. GitHub milestones bumped to match. Last updated / Dernière mise à jour / Zuletzt aktualisiert stamps refreshed to 27 May 2026 across all three locales. #250.
• FR / DE prose em-dash sweep (#164). Four user-visible em-dashes in prose strings rewritten to commas per CLAUDE.md §7: the contact-form success toast on /index.fr.html + /index.de.html and the directory tour's country-filter chip body on /people.fr.html + /people.de.html. Decorative em-dashes wrapping the Activity window timeline label on /grants.html (+ FR + DE) deliberately kept since EN ships them as visual brackets, not prose punctuation, and locale divergence here would create inconsistency. Closes the FR / DE half of the voice-rule sweep that v1.8.0 only applied to EN public copy (#223).

Fixed

• Beta-translation ribbon "View in English" link now sticks (#253). The nav .lang-switch chips persist the chosen language to localStorage.netsec-lang on click, and the auto-redirect in assets/js/site.js then sends EN visitors to the saved FR / DE variant on every subsequent page load (the asymmetry is deliberate, EN remains the authoritative fallback). The ribbon's <a hreflang="en">Voir en anglais → / Auf Englisch ansehen →</a> link sits outside .lang-switch, so it wasn't getting the same persistence treatment — clicking it landed on EN briefly, then the auto-redirect bounced the visitor straight back. Same handler now binds to .i18n-beta-ribbon a[hreflang] so the ribbon-driven EN switch persists as the user's deliberate preference. No HTML change needed; one diff in site.js.

🤖 Authored with help from Claude Code.