Skip to content

v1.11.0 — OpenSSF Best Practices compliance (Level 3)

Marketplace
Marketplace

Choose a tag to compare

View all tags
@Richonn Richonn released this 04 Apr 01:29
· 32 commits to main since this release
v1.11.0
5d0071b
This commit was signed with the committer’s verified signature.
Richonn Richonn
GPG key ID: 69DD7A8CACEA7A96
Verified
Learn about vigilant mode.

What's new

Release verification instructions

README.md now includes a dedicated "Verifying releases" section with step-by-step
instructions to verify the integrity and authorship of any ShieldCI release using
slsa-verifier against the SLSA Level 3
provenance attestation stored in the public Rekor transparency log.

slsa-verifier verify-image ghcr.io/richonn/shieldci:<sha> \
  --source-uri github.com/Richonn/ShieldCI \
  --source-tag <version>

SBOM attached to GitHub Releases

The sbom.yml workflow now triggers on published releases in addition to pushes to main.
The SBOM generated by Syft is automatically attached as a downloadable asset to each GitHub
Release, making dependency manifests available alongside every release artifact.

Security policy expanded

SECURITY.md now documents:

  • Secrets and Credentials Policy — PAT minimum scopes, keyless signing rationale, Gitleaks
    enforcement, and rotation procedure
  • SCA Policy — remediation threshold (CRITICAL/HIGH must be fixed before merge), pre-release
    gate enforced by Trivy, license compatibility requirement, and Dependabot cadence
  • Support scope and duration — v1.x receives security patches, critical bug fixes, and
    feature updates until a v2.x major release is published
  • End-of-life notice policy — 90-day critical-security-only maintenance window before
    end-of-life, with public announcement at least 90 days in advance
Assets 3
Loading