BCGov Crow - v0.12.0

BCGov Crow - v0.12.0

Release type

Minor release

Summary

Crow separates routine framework and dependency maintenance from security
remediation with a dedicated update agent and focused skills included in the
Starter Package and full Crow package.

Highlights

• The Crow Framework & Dependency Update Agent supports framework/runtime,
  third-party dependency, and combined update scopes without requiring
  security-review reports or ticket workflows.
• Scheduled or unattended runs are limited to supported, non-breaking
  patch/minor updates, defer components without baseline verification, and
  restore a failed component after verification; migrations needing human
  decisions are reported and deferred. Crow does not configure a scheduler.
• Security Remediation retains its existing framework and dependency scopes
  as deprecated compatibility routes through the new skills, while verified
  security findings remain in the security-remediation workflow.
• Security-ticket scopes run applicable vulnerability remediation, hardening,
  and test work only for findings in the validated ticket backlog.
• The dependency-update skill routes inventories through a technology-grouped
  package-manager catalog and supports ecosystems without lockfiles when the
  selected manager and repository policy do not require one.
• Pull-request asset validation checks local links, skill-routing dependencies,
  and whether each collection bundles the transitive skills and modules used by
  its agents.

Changes

• Added crow-framework-updates and crow-dependency-updates skills with
  evidence, compatibility, manager-specific lockfile, advisory-check, and
  verification guidance.
• Added a package-manager inventory and routing module covering application
  ecosystems, infrastructure, containers, and non-standard inputs.
• Included the agent and skills in the Starter Package, and updated the
  Security Remediation collection for the deprecated compatibility routes.
• Added a dependency-graph check and regression tests to the Crow asset
  validator; both collections now include the project-context
  technology-preferences module they conditionally use.
• Updated ticket-scope gates, known-skill routing, module-only dependency
  handling, and repository-root link validation.
• Updated package discovery metadata, collection manifests, installation
  examples, and links for Crow v0.12.0.

Validation

• Crow asset validation: Passed — 0 errors, 0 warnings.
• Dependency-graph and Security Remediation scope regression tests: Passed.
• PowerShell lint: Passed for changed scripts.
• Package dry run: Passed — 219 files.
• Archive inspection: Required before draft publication.
• Additional checks: Release-draft and package-version guard tests passed;
  git diff --check passed. Sonar quality gate: Passed, with 0 new issues;
  the generic scanner did not analyze C# files.

Artifacts

• Archive: bcgov-crow-0.12.0.zip
• SHA-256 file: bcgov-crow-0.12.0.zip.sha256
• SHA-256: b6b3b538eca64732f95efdea7a1bb841860c924973505d12c355456cd56b7cec

Installation

Install the tagged release globally:

apm install bcgov/crow#v0.12.0 --global --target copilot

Or install the packaged archive:

apm install .\build\bcgov-crow-0.12.0.zip --global --target copilot