mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-10-28 16:32:06 +00:00
41 lines
1.5 KiB
Markdown
41 lines
1.5 KiB
Markdown
# Release Protection Policy
|
|
|
|
Purpose: define repository protection requirements so releases cannot be published without passing integrity and audit gates.
|
|
|
|
## Branch Protection (default branch)
|
|
|
|
Require pull requests for protected branches and require status checks to pass before merge.
|
|
|
|
Minimum required checks:
|
|
- `Tests / test (ubuntu-latest, 3.11)`
|
|
- `Dependency Audit / audit` (scheduled/manual job should also be runnable on demand)
|
|
|
|
## Tag/Release Protection
|
|
|
|
Publishable release tags must be created only from protected branch tips and must be gated by successful release integrity checks.
|
|
|
|
Required controls:
|
|
1. Restrict who can create matching release tags (maintainers only).
|
|
2. Require successful `Release Integrity / verify-and-sign` before release publication.
|
|
3. Require successful dependency audit for the same commit/tag.
|
|
4. Require signed commits/tags per org policy where available.
|
|
|
|
## Manual Enforcement Checklist (until fully automated in platform settings)
|
|
|
|
Before publishing any release:
|
|
1. Confirm commit is on protected branch tip.
|
|
2. Run `Release Integrity` workflow and verify success.
|
|
3. Run `Dependency Audit` workflow and verify success (or documented time-boxed exception).
|
|
4. Verify release asset signature/checksum steps using `docs/release_verification_runbook.md`.
|
|
|
|
## Evidence Recording
|
|
|
|
For each release, capture:
|
|
- release tag,
|
|
- protected branch commit SHA,
|
|
- workflow run URLs (`Release Integrity`, `Dependency Audit`),
|
|
- reviewer/approver identity,
|
|
- verification runbook executor.
|
|
|
|
Record evidence in `docs/security_readiness_checklist.md`.
|