SafeAI v2.0.1 — Release Hardening

SafeAI v2.0.1 — Release Hardening

Consolidated release pipeline with mandatory verification gates, GPG-signed
artifacts, cross-platform verification instructions, and pre-release checklist.

What's New

• Consolidated release pipeline — 6-job pipeline: checklist → build →
  attest → sign → publish → release. Every gate must pass before the next.
  Builds pinned to exact release commit SHA.
• Pre-release checklist — blocks publication if version, rules, analyzers,
  compatibility tests, SARIF, JSON report, Action I/O, failure-class matrix,
  or CHANGELOG is inconsistent.
• GPG-signed artifacts — wheel, sdist, checksums, provenance, SBOM all
  signed with detached .asc signatures.
• Cross-platform verification (VERIFICATION.md) — step-by-step GPG,
  checksum, and provenance verification for Linux, macOS, Windows.

Verification

safeai --version  # Expected: 2.0.1

See VERIFICATION.md for full instructions.

Installation

pip install SafeAI-Static-Analyzer==2.0.1

Links

• Source Code
• Verification
• Release Notes