From bc39a45d792f31fbbdea69c65860d9c5937054ca Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Sun, 2 Aug 2026 11:38:23 +0200 Subject: [PATCH 1/5] docs: update changelog Signed-off-by: PythonWoods --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 78a93e2..ab95477 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,10 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [Unreleased] +- **Core Baseline Alignment**: Realigned default pinned Zenzic Core dependency to `0.27.0`. +- **Baseline & Regression Tracking**: Added documentation and example workflows for `--baseline .zenzic-baseline.json` and `--update-baseline`. +- **New Rule Diagnostic Support**: Automatic SARIF upload and PR annotations for new `Z4xx` (Smart Link Graph), `Z5xx` (Semantic Linting), and `Z1xx` (Configuration Engine) rules. + ## [2.10.4] - 2026-07-29 ### Fixed From b97342709dcbc132d6ef8b92294172b217d160ca Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Sun, 2 Aug 2026 12:31:24 +0200 Subject: [PATCH 2/5] docs: update changelog. Signed-off-by: PythonWoods --- CHANGELOG.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab95477..5eda227 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -37,6 +37,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.10.0] - 2026-07-25 +- *No notable changes. Internal version bump.* + ## [2.9.1] - 2026-07-22 ### Changed @@ -54,8 +56,12 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.8.2] - 2026-07-14 +- *No notable changes. Internal version bump.* + ## [2.8.1] - 2026-07-14 +- *No notable changes. Internal version bump.* + ## [2.8.0] - 2026-07-12 ### Added @@ -63,8 +69,12 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.7.1] - 2026-07-11 +- *No notable changes. Internal version bump.* + ## [2.7.0] - 2026-07-11 +- *No notable changes. Internal version bump.* + ## [2.6.2] - 2026-07-05 ### Changed @@ -102,6 +112,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.5.0] - 2026-07-01 +- *No notable changes. Internal version bump.* + ## [2.4.0] - 2026-06-28 ### Changed From 79de21fc4b277b4fb1c9e10bd68c63c094f5cf0a Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Sun, 2 Aug 2026 18:27:13 +0200 Subject: [PATCH 3/5] docs: update changelog and contributing documentation for clarity Signed-off-by: PythonWoods --- CHANGELOG.md | 23 +++++++++++++++++++++++ CONTRIBUTING.md | 3 ++- README.md | 5 ++++- RELEASE.md | 2 +- 4 files changed, 30 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5eda227..37bceb1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,16 +16,19 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.10.4] - 2026-07-29 ### Fixed + - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.5`. ## [2.10.3] - 2026-07-28 ### Fixed + - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.3`. ## [2.10.2] - 2026-07-28 ### Fixed + - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.2`, integrating critical URP unification and static asset resolution fixes. ## [2.10.1] - 2026-07-26 @@ -42,16 +45,19 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.9.1] - 2026-07-22 ### Changed + - **Dependencies**: Strictly pinned Zenzic Core dependency to version `0.23.1` (`zenzic == 0.23.1` @ SHA `67b4ee3632681065b304891ef388b99010d999bf`), deploying LSP `codeDescription` links and `[{code}]` diagnostic message prefixing per ADR-089 / ADR-090. ## [2.9.0] - 2026-07-18 ### Changed + - **Dependencies**: Pinned Zenzic core dependency to version `0.23.0` (introduces `ZenzicDiagnostic` strict typing, incremental VSM validation via `IncrementalAnalysisEngine`, `VirtualBufferOverlay` reverse index, and ADR-075 Radical Unawareness compliance in the Language Server). ## [2.8.3] - 2026-07-14 ### Changed + - **Dependencies**: Pinned Zenzic core dependency to version `0.22.3` (restoring 100% diagnostic parity and URP strict ordering). ## [2.8.2] - 2026-07-14 @@ -65,6 +71,7 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.8.0] - 2026-07-12 ### Added + - **Core Update**: Pinned Zenzic core dependency to version `0.22.0` (introduces Real-Time Virtual Site Map (VSM) integration and O(1) incremental patching to the Language Server). ## [2.7.1] - 2026-07-11 @@ -78,36 +85,44 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.6.2] - 2026-07-05 ### Changed + - **Dependencies**: Pinned Zenzic core dependency to version `0.20.3` (eradicates Z602 bilingual parity rules/fixtures, and aligns with English-Only documentation governance). ## [2.6.1] - 2026-07-04 ### Changed + - **Dependencies**: Pinned Zenzic core dependency to version `0.20.1` (restores slate-based dark mode and resolves Z603 Dead Suppression paradox). ## [2.6.0] - 2026-07-04 ### Added + - **Core Update**: Bumped Zenzic core dependency to `>=0.20.0` (introduces Custom Rules API v2, deterministic visitation sandbox, and auto-fix expansion for Z121 and Z603). ### Changed + - **Dependencies**: Pinned Zenzic core to `0.20.0`. ## [2.5.2] - 2026-07-04 ### 🔒 Security Advisory + - **Core Update**: Bumped Zenzic core dependency to `>=0.19.6` to mitigate the DQS Evasion (leading space bypass), TOML Bomb crash, and duplicate suppression consumption vulnerabilities. ### Changed + - **Dependencies**: Pinned Zenzic core to `0.19.6`. - **Automation**: Fixed the `pin-core` recipe in the `justfile` to correctly align the core pin in `action.yml`. ## [2.5.1] - 2026-07-03 ### 🔒 Security Advisory + - **Core Update**: Bumped Zenzic core dependency to `>=0.19.3` to mitigate the `Z205` (Forbidden Scheme) security gate bypass vulnerability (Double Href & Encoding Evasion). ### Changed + - **Dependencies**: Pinned Zenzic core to `0.19.3` to restore the deterministic execution environment. ## [2.5.0] - 2026-07-01 @@ -117,42 +132,50 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.4.0] - 2026-06-28 ### Changed + - **Core Update**: Pinned Zenzic core dependency to version `0.18.0` for full "Nuclear Static" compliance. - **Automation**: Fully automated the release pipeline, synchronizing `bump-my-version` across `SECURITY.md`, `RELEASE.md`, `CHANGELOG.md`, and `CONTRIBUTING.md` to eliminate manual drift. ## [2.3.1] - 2026-06-27 ### Added + - **SourceRank Visibility**: Added `requirements.txt` to expose Zenzic core dependency to ecosystem crawlers. - **Ecosystem Gate**: Upgraded `just versions` to perform parity validation between `action.yml` and `requirements.txt`. ### Changed + - **Perimeter Hygiene**: Added `requirements.txt` to `excluded_file_patterns` in `.zenzic.toml` to prevent `Z405` violations. - **Automation**: Updated `just pin-core` to propagate Zenzic core pins to `requirements.txt`. ## [2.3.0] - 2026-06-27 ### Changed + - **Governance**: Modernized pull request template for English-only python ecosystem. ## [2.2.2] - 2026-06-23 ### Changed + - **Dependencies**: Pinned Zenzic core to `0.15.1`. ## [2.2.1] - 2026-06-21 ### Fixed + - **SARIF**: Filtered out info-level notes from SARIF findings count. ## [2.2.0] - 2026-06-21 ### Changed + - **Engine Upgrade**: Upgraded Zenzic Core to `v0.15.0`. ## [2.1.1] - 2026-06-21 ### Fixed + - **Core Update**: Compatibility adjustments and version bumps. ## [2.1.0] - 2026-06-21 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 743e5c8..808a688 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -16,7 +16,7 @@ Thank you for contributing to the official GitHub Action for Zenzic! Zenzic is structured across three independent, dedicated repositories: | Repository | Purpose | Primary Stack | -|:---|:---|:---| +| :--- | :--- | :--- | | **[zenzic](https://github.com/PythonWoods/zenzic)** | Python Core analysis engine & CLI (`src/zenzic`) | Python 3.10+, `uv`, `pytest`, `mypy` | | **[zenzic-vscode](https://github.com/PythonWoods/zenzic-vscode)** | Official VS Code Extension (LSP Thin Client) | TypeScript, Node.js 24+, VS Code API | | **[zenzic-action](https://github.com/PythonWoods/zenzic-action)** (this repo) | Official GitHub Action CI/CD Wrapper | YAML, Bash, SARIF Upload | @@ -100,6 +100,7 @@ Both must pass with zero errors before opening or updating a PR. All `rev:` keys in `.pre-commit-config.yaml` must point to an **immutable commit hash pin**, never to a semantic tag (`v1.2.3`). Updating pinned hooks: + ```bash uvx pre-commit autoupdate --freeze ``` diff --git a/README.md b/README.md index 2b251e4..18fb015 100644 --- a/README.md +++ b/README.md @@ -71,7 +71,6 @@ Place a `.zenzic.toml` at the root of your repository and the action picks it up For advanced configuration (Configuration Discovery, Sovereign Override, Quality Gate scoring, nightly audit), see the [Zenzic Action docs](https://zenzic.dev/docs/reference/zenzic-action). - --- ## 🔍 Visual Feedback @@ -87,6 +86,7 @@ Zenzic Action surfaces findings directly where you work — no digging through C ## Integration Blueprints ### 1. Baseline Check (SAST & Topology Verification) + This blueprint provides static application security testing (SAST), link validation, and graph topology verification. It executes during pushes and PRs, ensuring no broken links, credential leaks, or invalid configurations enter the repository. ```yaml @@ -114,6 +114,7 @@ jobs: ``` ### 2. Security Hardening (SARIF + Upload Integration) + This blueprint runs a security-hardened gate. It executes the secret scanner (`guard-scan`) to catch exposed credentials and path traversals, then uploads the SARIF report directly to the GitHub Code Scanning Security tab. ```yaml @@ -145,6 +146,7 @@ jobs: ``` ### 3. PR Governance (Inline Annotations & DQS Tracking) + This blueprint implements pull-request governance. It downloads the DQS baseline from the default branch, runs the quality gate comparison, maps issues to inline annotations, and publishes a summary of the Document Quality Score (DQS) to the workflow run. ```yaml @@ -173,6 +175,7 @@ jobs: ``` ### 4. Sovereign Nightly Audit (Full Unfiltered Audit) + Runs an unsuppressed audit on schedule, reporting hidden technical debt directly to Code Scanning. ```yaml diff --git a/RELEASE.md b/RELEASE.md index c275342..42c75cb 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -6,7 +6,7 @@ | Field | Value | | :------ | :--------- | -| Version | v2.10.4 | +| Version | v2.10.4 | | Date | 2026-07-29 | | Status | Stable | From 15f9b779c8ad6c5c4d4c14cc2fa48b5ac011589f Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Sun, 2 Aug 2026 18:29:15 +0200 Subject: [PATCH 4/5] release: bump version to 2.11.0 (core 0.27.0) Signed-off-by: PythonWoods --- .bumpversion.toml | 4 ++-- CHANGELOG.md | 2 ++ README.md | 4 ++-- RELEASE.md | 18 +++++++++--------- SECURITY.md | 4 ++-- action.yml | 2 +- package.json | 2 +- pyproject.toml | 2 +- 8 files changed, 20 insertions(+), 18 deletions(-) diff --git a/.bumpversion.toml b/.bumpversion.toml index 0749ca0..5b5f224 100644 --- a/.bumpversion.toml +++ b/.bumpversion.toml @@ -2,7 +2,7 @@ # SPDX-License-Identifier: Apache-2.0 [tool.bumpversion] -current_version = "2.10.4" +current_version = "2.11.0" parse = "(?P\\d+)\\.(?P\\d+)\\.(?P\\d+)" serialize = ["{major}.{minor}.{patch}"] @@ -47,4 +47,4 @@ replace = '''| `{new_version}` (current) | ✅ All security fixes | # bump-my-version does NOT manage these files; they are listed here for discoverability. # --------------------------------------------------------------------------- [tool.bumpversion.custom_variables.core_version] -current = "0.26.5" +current = "0.27.0" diff --git a/CHANGELOG.md b/CHANGELOG.md index 37bceb1..048e5b0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [Unreleased] +## [2.11.0] - 2026-08-02 + - **Core Baseline Alignment**: Realigned default pinned Zenzic Core dependency to `0.27.0`. - **Baseline & Regression Tracking**: Added documentation and example workflows for `--baseline .zenzic-baseline.json` and `--update-baseline`. - **New Rule Diagnostic Support**: Automatic SARIF upload and PR annotations for new `Z4xx` (Smart Link Graph), `Z5xx` (Semantic Linting), and `Z1xx` (Configuration Engine) rules. diff --git a/README.md b/README.md index 18fb015..3e65207 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,7 @@ The minimal configuration — zero Python setup, SARIF to Code Scanning in one s - name: Run Zenzic Documentation Quality Gate uses: PythonWoods/zenzic-action@v2 with: - version: "0.26.5" + version: "0.27.0" format: sarif upload-sarif: "true" permissions: @@ -210,7 +210,7 @@ jobs: | Input | Default | Description | |:---|:---|:---| -| `version` | `0.26.5` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. | +| `version` | `0.27.0` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. | | `format` | `"text"` | Output format: `text`, `json`, or `sarif` | | `upload-sarif` | `"false"` | Automatically upload SARIF output to GitHub Code Scanning | diff --git a/RELEASE.md b/RELEASE.md index 42c75cb..bd3691c 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -6,17 +6,17 @@ | Field | Value | | :------ | :--------- | -| Version | v2.10.4 | -| Date | 2026-07-29 | +| Version | v2.11.0 | +| Date | 2026-08-02 | | Status | Stable | ## Release Checklist Before tagging, every item must be green: -- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.26.5`) -- [ ] `package.json` version bumped to `2.10.4` -- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.26.5`) +- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.27.0`) +- [ ] `package.json` version bumped to `2.11.0` +- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.27.0`) - [ ] `just versions` — returns `✅ Ecosystem alignment verified.` - [ ] `just verify` — exits 0 - [ ] `zenzic check .` — zero findings (DQS 100/100) @@ -43,15 +43,15 @@ git checkout main git pull origin main # 7. Create the release tag and push -git tag -s -m "Release v2.10.4" v2.10.4 -git push origin v2.10.4 +git tag -s -m "Release v2.11.0" v2.11.0 +git push origin v2.11.0 # 8. Move the floating v2 tag to the new release: -git tag -s -fa v2 v2.10.4^{} -m "release: v2.10.4" +git tag -s -fa v2 v2.11.0^{} -m "release: v2.11.0" git push origin v2 --force # Verification (Atomic Parity Check): -git rev-parse v2^{} v2.10.4^{} +git rev-parse v2^{} v2.11.0^{} # SUCCESS: Both hashes must be identical. ``` diff --git a/SECURITY.md b/SECURITY.md index eaf27d4..247a017 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -75,8 +75,8 @@ by the wrapper script — it is consumed exclusively by `github/codeql-action/up | Version | Support status | |---------|----------------| -| `2.10.4` (current) | ✅ All security fixes | -| `< 2.10.4` | ❌ End of life — no support | +| `2.11.0` (current) | ✅ All security fixes | +| `< 2.11.0` | ❌ End of life — no support | --- diff --git a/action.yml b/action.yml index 3e1da54..4fcd54f 100644 --- a/action.yml +++ b/action.yml @@ -16,7 +16,7 @@ inputs: version: description: "Zenzic version to use. Defaults to latest stable." required: false - default: "0.26.5" # x-zenzic-core-pin + default: "0.27.0" # x-zenzic-core-pin format: description: "Output format: 'text', 'json', or 'sarif'." required: false diff --git a/package.json b/package.json index 185efa6..e129a81 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "zenzic-action", - "version": "2.10.4", + "version": "2.11.0", "private": true, "description": "Official GitHub Action for Zenzic — Documentation Quality Gate", "license": "Apache-2.0", diff --git a/pyproject.toml b/pyproject.toml index 2624a39..29713b5 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,7 @@ license = {text = "Apache-2.0"} authors = [{name = "PythonWoods", email = "dev@pythonwoods.dev"}] dynamic = ["version"] dependencies = [ - "zenzic==0.26.5", + "zenzic==0.27.0", ] [project.urls] From c33a968e11cc0fc50788427640876cb474214002 Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Sun, 2 Aug 2026 20:01:49 +0200 Subject: [PATCH 5/5] fix(docs): resolve Z512/Z411 structural findings for 100/100 DQS~ Signed-off-by: PythonWoods --- CHANGELOG.md | 44 +++++++++++++++++++++++++++++++++++++++++ CONTRIBUTING.md | 6 ++++++ README.md | 2 ++ SECURITY.md | 6 ++++++ changelogs/v1.x.md | 14 +++++++++++++ tests/fixture/README.md | 2 ++ 6 files changed, 74 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 048e5b0..3b35a8f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [Unreleased] +*No notable changes pending.* + ## [2.11.0] - 2026-08-02 - **Core Baseline Alignment**: Realigned default pinned Zenzic Core dependency to `0.27.0`. @@ -17,24 +19,32 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.10.4] - 2026-07-29 +Patch release — Zenzic Core dependency realignment. + ### Fixed - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.5`. ## [2.10.3] - 2026-07-28 +Patch release — Zenzic Core dependency realignment. + ### Fixed - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.3`. ## [2.10.2] - 2026-07-28 +Patch release — Zenzic Core dependency realignment with critical URP fixes. + ### Fixed - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.2`, integrating critical URP unification and static asset resolution fixes. ## [2.10.1] - 2026-07-26 +Dependency pin update. + ### Changed - **Dependencies**: Pinned Zenzic Core dependency to version `0.25.3`, inheriting fixes for Zensical framework static asset mapping and PolyglotExtractor AST reference link definition extraction (`CORE-FIX-001`). @@ -46,18 +56,24 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.9.1] - 2026-07-22 +Patch release — strict Zenzic Core dependency pin. + ### Changed - **Dependencies**: Strictly pinned Zenzic Core dependency to version `0.23.1` (`zenzic == 0.23.1` @ SHA `67b4ee3632681065b304891ef388b99010d999bf`), deploying LSP `codeDescription` links and `[{code}]` diagnostic message prefixing per ADR-089 / ADR-090. ## [2.9.0] - 2026-07-18 +Minor release — incremental VSM validation and Radical Unawareness compliance. + ### Changed - **Dependencies**: Pinned Zenzic core dependency to version `0.23.0` (introduces `ZenzicDiagnostic` strict typing, incremental VSM validation via `IncrementalAnalysisEngine`, `VirtualBufferOverlay` reverse index, and ADR-075 Radical Unawareness compliance in the Language Server). ## [2.8.3] - 2026-07-14 +Patch release — Zenzic Core dependency pin restoring diagnostic parity. + ### Changed - **Dependencies**: Pinned Zenzic core dependency to version `0.22.3` (restoring 100% diagnostic parity and URP strict ordering). @@ -72,6 +88,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.8.0] - 2026-07-12 +Minor release — Real-Time Virtual Site Map (VSM) integration. + ### Added - **Core Update**: Pinned Zenzic core dependency to version `0.22.0` (introduces Real-Time Virtual Site Map (VSM) integration and O(1) incremental patching to the Language Server). @@ -86,18 +104,24 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.6.2] - 2026-07-05 +Patch release — English-only governance alignment. + ### Changed - **Dependencies**: Pinned Zenzic core dependency to version `0.20.3` (eradicates Z602 bilingual parity rules/fixtures, and aligns with English-Only documentation governance). ## [2.6.1] - 2026-07-04 +Patch release — dark mode restoration and Z603 Dead Suppression paradox fix. + ### Changed - **Dependencies**: Pinned Zenzic core dependency to version `0.20.1` (restores slate-based dark mode and resolves Z603 Dead Suppression paradox). ## [2.6.0] - 2026-07-04 +Minor release — Custom Rules API v2 and auto-fix expansion. + ### Added - **Core Update**: Bumped Zenzic core dependency to `>=0.20.0` (introduces Custom Rules API v2, deterministic visitation sandbox, and auto-fix expansion for Z121 and Z603). @@ -108,6 +132,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.5.2] - 2026-07-04 +Security patch — critical vulnerability mitigations in Zenzic Core. + ### 🔒 Security Advisory - **Core Update**: Bumped Zenzic core dependency to `>=0.19.6` to mitigate the DQS Evasion (leading space bypass), TOML Bomb crash, and duplicate suppression consumption vulnerabilities. @@ -119,6 +145,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.5.1] - 2026-07-03 +Security patch — Z205 Forbidden Scheme bypass vulnerability fix. + ### 🔒 Security Advisory - **Core Update**: Bumped Zenzic core dependency to `>=0.19.3` to mitigate the `Z205` (Forbidden Scheme) security gate bypass vulnerability (Double Href & Encoding Evasion). @@ -133,6 +161,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.4.0] - 2026-06-28 +Minor release — Nuclear Static compliance and automated release pipeline. + ### Changed - **Core Update**: Pinned Zenzic core dependency to version `0.18.0` for full "Nuclear Static" compliance. @@ -140,6 +170,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.3.1] - 2026-06-27 +Patch release — SourceRank visibility and ecosystem gate improvements. + ### Added - **SourceRank Visibility**: Added `requirements.txt` to expose Zenzic core dependency to ecosystem crawlers. @@ -152,36 +184,48 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [2.3.0] - 2026-06-27 +Patch release — pull request governance modernisation. + ### Changed - **Governance**: Modernized pull request template for English-only python ecosystem. ## [2.2.2] - 2026-06-23 +Patch release — Zenzic Core dependency pin. + ### Changed - **Dependencies**: Pinned Zenzic core to `0.15.1`. ## [2.2.1] - 2026-06-21 +Patch release — SARIF info-level findings count fix. + ### Fixed - **SARIF**: Filtered out info-level notes from SARIF findings count. ## [2.2.0] - 2026-06-21 +Minor release — Zenzic Core engine upgrade to v0.15.0. + ### Changed - **Engine Upgrade**: Upgraded Zenzic Core to `v0.15.0`. ## [2.1.1] - 2026-06-21 +Patch release — compatibility adjustments and version bumps. + ### Fixed - **Core Update**: Compatibility adjustments and version bumps. ## [2.1.0] - 2026-06-21 +Breaking minor release — dropped Docusaurus support, action bumped to v2. + ### Changed (Breaking) - **Dropped Docusaurus Support**: Upgraded the pinned Zenzic Core to `v0.13.0`, which surgically eradicates the Docusaurus adapter due to ontological incompatibility (React-injected IDs and MDX partial merging). Projects still relying on Docusaurus MUST remain on the `v1` floating tag (`v1.3.x`). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 808a688..b9cd29f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -95,6 +95,8 @@ Both must pass with zero errors before opening or updating a PR. ## Maintainer Only: Workflow Hardening & Release Procedure +The following procedures are reserved for repository maintainers with release permissions. They must be executed in the documented sequence to preserve ecosystem integrity. + ### Immutable Pre-Commit Hooks (ADR-089) All `rev:` keys in `.pre-commit-config.yaml` must point to an **immutable commit hash pin**, never to a semantic tag (`v1.2.3`). @@ -123,3 +125,7 @@ just audit-release # 5. Push commit and tag git push && git push --tags ``` + +--- + +See also: [README](README.md) diff --git a/README.md b/README.md index 3e65207..95dc861 100644 --- a/README.md +++ b/README.md @@ -85,6 +85,8 @@ Zenzic Action surfaces findings directly where you work — no digging through C ## Integration Blueprints +The following ready-to-use GitHub Actions workflow templates cover the four primary integration patterns for `zenzic-action`. + ### 1. Baseline Check (SAST & Topology Verification) This blueprint provides static application security testing (SAST), link validation, and graph topology verification. It executes during pushes and PRs, ensuring no broken links, credential leaks, or invalid configurations enter the repository. diff --git a/SECURITY.md b/SECURITY.md index 247a017..693cc93 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -5,6 +5,8 @@ SPDX-License-Identifier: Apache-2.0 # Security Policy — zenzic-action +This document defines the security disclosure process for `zenzic-action`. For the Zenzic Core security policy, see [github.com/PythonWoods/zenzic](https://github.com/PythonWoods/zenzic/blob/main/SECURITY.md). + ## Scope This policy covers **zenzic-action** — the official GitHub Action that runs @@ -85,3 +87,7 @@ by the wrapper script — it is consumed exclusively by `github/codeql-action/up We follow a **coordinated disclosure** model. We ask that you allow up to 14 days for a patch to be released before any public disclosure. Confirmed reporters will be credited in the release changelog unless they prefer to remain anonymous. + +--- + +See also: [README](README.md) diff --git a/changelogs/v1.x.md b/changelogs/v1.x.md index 7ea7534..e6d662d 100644 --- a/changelogs/v1.x.md +++ b/changelogs/v1.x.md @@ -3,8 +3,12 @@ # Changelog Archive: v1.3.x +This archive covers v1.3.x releases. See the [main changelog](../CHANGELOG.md) for current release history. + ## [1.3.5] - 2026-06-09 +v1.3.5 patch release. + ### Changed - **Operational governance docs:** Added explicit branch-protection policy to `README.md` and `README.it.md`, including required checks for `main` (`Verify (ubuntu-latest, true)`, `Lint PR Title`, `Check DCO`) and fail-closed workflow selection rules. @@ -14,6 +18,8 @@ ## [1.3.4] - 2026-06-08 +v1.3.4 patch release. + ### Changed - **Core pin:** Zenzic Core pinned to `0.10.3`. @@ -23,6 +29,8 @@ ## [1.3.3] - 2026-06-07 +v1.3.3 patch release. + ### Changed - **Core pin:** Zenzic Core pinned to `0.10.2`. @@ -31,6 +39,8 @@ ## [1.3.2] - 2026-06-07 +v1.3.2 patch release. + ### Changed - Disabled dependency caching in `setup-uv` to prevent noisy warnings on non-Python repositories. @@ -39,6 +49,8 @@ ## [1.3.1] - 2026-06-07 +v1.3.1 patch release. + ### Deprecated - **Versions v1.3.0 and older are officially deprecated.** They contained a critical bug in the bash wrapper that injected an invalid `--config` flag, causing false-positive Exit 2 crashes. Users pinned to exact patch versions must upgrade to `v1.3.1` or use the major tag `@v1`. @@ -66,6 +78,8 @@ ## [1.3.0] - 2026-06-06 +v1.3.0 patch release. + ### Changed - Update action configuration to Magnetite codename. diff --git a/tests/fixture/README.md b/tests/fixture/README.md index 591baa7..1d39f23 100644 --- a/tests/fixture/README.md +++ b/tests/fixture/README.md @@ -5,3 +5,5 @@ SPDX-License-Identifier: Apache-2.0 # Fixture This is a minimal valid markdown test fixture designed to safely pass the Zenzic quality gate checks without raising the Z502 word count warning. It contains enough words to satisfy the fifty word minimum requirement for markdown pages evaluated by the analyzer engine during the continuous integration process testing. This ensures our local tests pass successfully without any manual suppression tags or additional overhead needed. + +See the [project README](../../README.md) for full documentation.