RELEASE.md

Release Process

Doctrine v11 LOCKED · 749/14/163 · locked_at c7c0ba17

This repo ships via .github/workflows/release.yml (OPS WAVE A, item 13).

Flow (on push to main)

1. Version bump — simple monotonic counter v0.1.N (next-tag computed from existing tags).
2. Tag + GitHub Release — created via softprops/action-gh-release, auto-generated notes.
3. Sign artifacts — cosign sign-blob keyless (GitHub OIDC); .sig + .crt attached to the release.
4. SLSA L1 provenance — slsa-framework/slsa-github-generator generic generator emits provenance-<tag>.intoto.jsonl attached to the release.

Verifying a release

cosign verify-blob \
  --certificate <artifact>.crt --signature <artifact>.sig \
  --certificate-identity-regexp 'https://github.com/szl-holdings/a11oy/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <artifact>

Permissions note

Requires id-token: write (already set in the workflow). If releases fail to create PRs/tags, the org may need: Settings → Actions → General → Workflow permissions → read+write.

Co-Authored-By: Perplexity Computer Agent