Skip to content

v0.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Aug 00:15
· 238 commits to main since this release
v0.1.1
870275c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.1.1 — Hardening and governance PATCH

Compiled output is byte-identical to 0.1.0 (golden-suite enforced); everything here is
validation, supply chain, documentation, and tests.

  • Fix: policy-id validation now uses fullmatch — an id with a trailing newline
    was accepted by Python's $-before-newline matching. Found by the new
    property-based suite.
  • Supply chain: every GitHub Action pinned to a commit SHA; least-privilege
    permissions: on all workflows; pip installs hash-pinned via compiled requirements;
    release artifacts now carry build provenance attestations; weekly coverage-guided
    fuzzing (atheris) of the id and selection parsers.
  • Governance docs: GOVERNANCE.md (decision-making, roles, access continuity) and a
    public roadmap index; SECURITY.md gains advisory URL and response timelines.
  • Tests: property-based suite for id validation and agent selection; unit suites
    for the lifecycle umbrellas and frontier ingestion (statement coverage 78% → 81%).
  • Marketplace: the GitHub Action is listed as "Chock Governance Check" with branding.
Assets 6
Loading