release-lab

Least privilege is the default and the explicit setting: the repository baseline sets the workflow token to read-only permissions, and every workflow declares its own minimal permissions: block on top of that. A job that specifies nothing therefore gets read, not write. https://github.com/monumental-archive/.github/tree/main/settings

Every release is a unique semantic version, derived from conventional commits by git-cliff and tagged v<major>.<minor>.<patch> by the release App; the tag ruleset makes tags immutable, so a version identifier is never reused.

CHANGELOG.md is generated by git-cliff from conventional commits and the same descriptive log is attached to each GitHub release, so every functional and security modification is recorded per version. https://github.com/monumental-archive/release-lab/blob/main/CHANGELOG.md

Dependency ingestion is standardised and locked: cargo with a committed Cargo.lock for crates, mise with a lockfile carrying per-platform checksums for tools, base images by digest, and cargo-deny restricting sources to a single registry with unknown-registry and unknown-git denied.

Each release carries Sigstore evidence bundles and GitHub artifact attestations covering every published asset by cryptographic digest — nine bundles on v0.24.4 — and the governance repository's runbook documents how a consumer verifies them. https://github.com/monumental-archive/.github/blob/main/docs/runbook.md#verifying-as-a-consumer-would

Documented in two places and deliberately so: docs/tooling-verdicts.md records how a dependency is selected — the priors a tool must meet to enter the belt, and the verdicts on tools considered and declined — and docs/dependency-track.md records how dependencies are obtained, pinned, monitored and triaged. https://github.com/monumental-archive/.github/blob/main/docs/tooling-verdicts.md

README.md gives the whole sequence: mise trust && mise install brings every required tool at its pinned version from the lockfile, and mise run ci then runs exactly what CI runs. https://github.com/monumental-archive/release-lab/blob/main/README.md

docs/continuity.md carries an asset table naming who holds each sensitive resource — organisation ownership, the tag-mint App key, registry accounts, the one standing token — and what happens to each if that person is unavailable. https://github.com/monumental-archive/.github/blob/main/docs/continuity.md

GOVERNANCE.md carries a 'Roles and responsibilities' table naming three roles - maintainer/owner, contributor, automation - and the responsibilities of each, and it is served from the organisation's .github repository as a default community health file so it applies to every repository that does not carry its own. Who holds the maintainer role is explicit: the @monumental-archive/owners team, which CODEOWNERS routes every review to. https://github.com/monumental-archive/.github/blob/main/GOVERNANCE.md#roles-and-responsibilities

CONTRIBUTING.md includes a 'Requirements for acceptable contributions' section: pull request only, a green mise run ci, Conventional Commits with imperative lowercase subjects under 72 columns, DCO sign-off, squash merge. https://github.com/monumental-archive/.github/blob/main/CONTRIBUTING.md

Every commit must carry a Developer Certificate of Origin 1.1 sign-off asserting legal authorisation. The commit-msg hook catches a missing trailer locally and lint:dco fails the gate, with no exemption list — automation signs off too.

gate.yml is a required status check on main under an organisation ruleset: direct pushes are blocked entirely and a pull request cannot merge red, so no commit reaches the default branch without the full gate — the lint belt, cargo test --workspace --locked and the coverage ratchet — having passed. https://github.com/monumental-archive/release-lab/blob/main/.github/workflows/gate.yml

gate.yml runs the full automated suite — the shared lint belt, cargo test --workspace --locked and the coverage ratchet — on every pull request before it can be accepted. https://github.com/monumental-archive/release-lab/blob/main/.github/workflows/gate.yml

The pipeline this repository runs is specified actor by actor and action by action in the governance repository's docs/release.md, and this repository's README maps each of its own caller stubs — gate, release, publish, continuous, exercise-sign, source-attest, audit, audit-repro, scorecard — to what that stub proves. https://github.com/monumental-archive/release-lab/blob/main/README.md

The external interfaces are the caller stubs' inputs and the published packages. Each stub and its inputs are documented in README.md here and specified in the governance repository's docs/runbook.md; the published artefacts are the crate, the npm package, the images and the per-major extension packages, each named and described per release. https://github.com/monumental-archive/release-lab/blob/main/README.md

docs/build-assessment.md and docs/source-assessment.md are written security assessments of this system: they walk the controls, name the most likely and impactful failure modes (untrusted caller code reaching a privileged signing identity, supply-chain substitution through unpinned dependencies, silent settings drift), and record which are mitigated and which are accepted. https://github.com/monumental-archive/.github/blob/main/docs/build-assessment.md

SECURITY.md is the coordinated disclosure policy and it states the timeframe: private reporting through the repository's Security tab, acknowledgement within 14 days, and what the reporter can expect afterwards. https://github.com/monumental-archive/.github/blob/main/SECURITY.md

GitHub private vulnerability reporting is enabled and is the documented channel in SECURITY.md, delivering the report directly to the security contact without public exposure. https://github.com/monumental-archive/.github/blob/main/SECURITY.md

Vulnerability data for this repository is published rather than held privately: a resolved report would be published as a GitHub Security Advisory here, and dependency findings already ship publicly with every release as an OpenVEX document (release-lab-0.24.4.vex.openvex.json) recording each decision against the release's SBOM. https://github.com/monumental-archive/release-lab/releases/tag/v0.24.4