From 8299c9033fb3ddda35efdcab97fcdfb914a0bb2e Mon Sep 17 00:00:00 2001 From: Binay <150876063+bkd-dotcom@users.noreply.github.com> Date: Tue, 1 Sep 2026 10:59:54 -0400 Subject: [PATCH] =?UTF-8?q?release:=20v0.3.0=20=E2=80=94=20governance=20le?= =?UTF-8?q?aderboard,=2060-case=20corpus,=20Apache-2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rolls Unreleased into 0.3.0, bumps the signetry-core pin to the v0.8.0 release, and relocks against it. docs/LEADERBOARD.{md,json} are deliberately left alone. They say "signetry-core 0.7.0" because that is the version the numbers were measured against, and editing that label by hand would assert a measurement that never ran. leaderboard.yml regenerates both on `release: published` from the core it actually installs, so publishing this release re-measures and the label updates itself. SECURITY.md's supported-versions table claimed 0.2.3 had working pinned real-repo cases. It did not — that fix is in this release, per the changelog — so 0.2.3 moves into the superseded range where it belongs. --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- .github/workflows/reviewer.yml | 2 +- CHANGELOG.md | 2 +- SECURITY.md | 4 ++-- pyproject.toml | 4 ++-- uv.lock | 8 ++++---- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 58b4cc7..aa95aff 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -57,7 +57,7 @@ body: id: core-version attributes: label: signetry-core version - description: The pin you installed (e.g. `v0.7.0`), or the output of `signetry --version`. + description: The pin you installed (e.g. `v0.8.0`), or the output of `signetry --version`. validations: required: true diff --git a/.github/workflows/reviewer.yml b/.github/workflows/reviewer.yml index 016d5ae..ea8d1bd 100644 --- a/.github/workflows/reviewer.yml +++ b/.github/workflows/reviewer.yml @@ -35,7 +35,7 @@ jobs: python-version: "3.12" - name: Install signetry-reviewer # signetry-reviewer is not published on PyPI; install it from its source repo. - run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.2.0" + run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.3.0" - name: Compute the PR diff env: BASE_SHA: ${{ github.event.pull_request.base.sha }} diff --git a/CHANGELOG.md b/CHANGELOG.md index d8e5ed9..8dabc8d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,7 @@ Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/). Until `1.0.0` the public API may change between minor versions. -## [Unreleased] +## [0.3.0] — 2026-09-01 ### Added — the Agent Governance Leaderboard diff --git a/SECURITY.md b/SECURITY.md index c84b399..e0043f0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -14,8 +14,8 @@ Always run the latest — the corpus and the pinned `signetry-core` move togethe | Version | Supported | |---|---| -| `0.2.3` | ✅ current — 7-language detection corpus, pinned real-repo cases, `signetry-core` `v0.7.0` | -| `0.2.0`–`0.2.2` | ⚠️ superseded — the "pinned" real-repo cases were silently scanning the default-branch tip (see `CHANGELOG.md`) | +| `0.3.0` | ✅ current — the governance leaderboard, 60-case OWASP corpus, `signetry-core` `v0.8.0` | +| `0.2.0`–`0.2.3` | ⚠️ superseded — the "pinned" real-repo cases were silently scanning the default-branch tip (see `CHANGELOG.md`) | | `< 0.2.0` | ❌ upgrade | ## Reporting a vulnerability diff --git a/pyproject.toml b/pyproject.toml index 00c307e..16d22fd 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "signetry-eval" -version = "0.2.3" +version = "0.3.0" description = "The public adversarial evaluation suite for Signetry: measures attack success rate (ASR) and utility-under-defense for coding-agent prompt injection, skill/MCP poisoning, and memory-injection threats, governed by signetry-core." readme = "README.md" requires-python = ">=3.11" @@ -22,7 +22,7 @@ classifiers = [ "Topic :: Software Development :: Quality Assurance", ] dependencies = [ - "signetry-core @ git+https://github.com/Signetry/core@v0.7.0", + "signetry-core @ git+https://github.com/Signetry/core@v0.8.0", ] [project.urls] diff --git a/uv.lock b/uv.lock index 58c3c44..f594a9e 100644 --- a/uv.lock +++ b/uv.lock @@ -308,8 +308,8 @@ wheels = [ [[package]] name = "signetry-core" -version = "0.7.0" -source = { git = "https://github.com/Signetry/core?rev=v0.7.0#0d39eb34f32152f5a3015ce9282245e38c25d9fc" } +version = "0.8.0" +source = { git = "https://github.com/Signetry/core?rev=v0.8.0#ee974f324aca0fd35726569d4a1c4f55a5a75a2e" } dependencies = [ { name = "cryptography" }, { name = "pyyaml" }, @@ -317,7 +317,7 @@ dependencies = [ [[package]] name = "signetry-eval" -version = "0.2.3" +version = "0.3.0" source = { editable = "." } dependencies = [ { name = "signetry-core" }, @@ -333,6 +333,6 @@ dev = [ requires-dist = [ { name = "pytest", marker = "extra == 'dev'", specifier = ">=8.0.0" }, { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.6.0" }, - { name = "signetry-core", git = "https://github.com/Signetry/core?rev=v0.7.0" }, + { name = "signetry-core", git = "https://github.com/Signetry/core?rev=v0.8.0" }, ] provides-extras = ["dev"]