Parent epic: #155
Deliver docs/release-process.md — the release playbook as an executable checklist, per E19 (#155).
Content
- Normal release: release-please handles tag + GitHub Release on PR merge (Conventional Commits precondition); the
release.published workflow fills the SBOM template, computes the source-tree hash, signs both with cosign (keyless/OIDC), and attaches them. No binary artefacts.
- Security-release coordination: High/Critical via GitHub private-fork workflow from a draft GHSA (develop privately, merge, publish advisory coordinated with release); Low/Medium fixed in the open, advisory publishes when the fix ships. The draft GHSA is the single tracking record.
Dependency flag
release-please is currently parked (PR #575) with a dangling 0.1.0 PR #101. When this story runs, either resolve the parked state or document intended-vs-current flow. Likely pairs with the release-please-unpark story (spun up during the docs-site / release phase).
Acceptance
docs/release-process.md present; a dry-run of the release flow produces SBOM + hash + signatures that verify.
Parent epic: #155
Deliver
docs/release-process.md— the release playbook as an executable checklist, per E19 (#155).Content
release.publishedworkflow fills the SBOM template, computes the source-tree hash, signs both with cosign (keyless/OIDC), and attaches them. No binary artefacts.Dependency flag
release-please is currently parked (PR #575) with a dangling
0.1.0PR #101. When this story runs, either resolve the parked state or document intended-vs-current flow. Likely pairs with the release-please-unpark story (spun up during the docs-site / release phase).Acceptance
docs/release-process.mdpresent; a dry-run of the release flow produces SBOM + hash + signatures that verify.