Skip to content
SLSA

Releases

All versionsAll versions forward

Version 0.2.0

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Added

  • Governance files. AI_COVENANT.md, SECURITY.md, NOTICE, this changelog, and issue and pull request templates.
  • Attribution for the SLSA specification copy and the Secure Software Factory whitepaper, in the README and NOTICE, as their licenses ask.
  • lint-and-docs.yaml: ShellCheck, actionlint, word budgets, markdownlint, link checks and codespell.
  • upstream-watch.yaml: a weekly check that src/slsa/schema/spec/ still matches SLSA’s tag v1.2 and that no newer version is tagged.
  • Releases through semantic-release, from this changelog, dispatching the PyPI upload and the knowledge bundle zip behind repository variables.

Changed

  • The distribution is slsa-linkml; the import package stays slsa. PyPI publishing is off until PYPI_RELEASE_ENABLED is true.
  • just lint reports errors only, as CI now runs it; the schema has no lint errors and 85 warnings.
  • docs/schema/slsa.yaml is regenerated from the current schema; it still carried the description from before the last schema change.

Security

  • Every workflow pins its actions to commit SHAs, runs harden-runner in audit mode, and declares permissions: {} at the top; Dependabot groups the action and dependency updates.