wdm

The GitHub repository is configured with read-only default workflow token permissions. Workflows also declare explicit least-privilege permissions; write permissions are granted only to jobs that need them, such as CodeQL SARIF upload and the tag-gated release publishing job

Official releases use unique semantic version tags such as v1.0.0. The release workflow only publishes from refs/tags/v* and stamps the built binary with the tag
version, so each official release is tied to a unique version identifier.

Non-trivial release notes file in repository: https://github.com/wnstify/wdm/blob/main/CHANGELOG.md. [release_notes]

The build and release pipeline uses standard Go module tooling for dependencies. CI uses actions/setup-go, go mod verify, go mod tidy -diff, go build, go test, govulncheck, and the checked-in go.mod/go.sum files. Release artifacts are built by GitHub Actions using the same Go module dependency mechanism.

Official releases include SHA256SUMS, which lists cryptographic hashes for the release payload assets. SHA256SUMS is signed with a detached Ed25519 signature and also covered by a keyless cosign/Sigstore bundle. SECURITY.md documents how to verify the signed manifest and then verify each asset hash.

The repository documents that Go dependencies are managed through go.mod and go.sum, with make tidy used to maintain them. CI verifies go.mod/go.sum with go mod verify and go mod tidy -diff, and Dependabot is configured to track Go module updates.

CONTRIBUTING.md documents the build prerequisites, including Go 1.26, Docker 20.10+ with Compose V2 for e2e tests, and the Linux amd64 target. It also lists the Make targets for building, testing, linting, vetting, formatting, tidying dependencies, and running e2e tests.

CODEOWNERS lists @wnstfy as the repository maintainer responsible for all paths in the project. The project currently has a single maintainer with access to sensitive
repository resources such as repository settings, protected branches, Actions secrets, and release controls.

CODEOWNERS documents that @wnstfy is the repository maintainer responsible for reviewing changes to every path. CONTRIBUTING.md documents contributor responsibilities
for focused commits, running checks, opening pull requests, following the code of conduct, and reporting security issues privately.

CONTRIBUTING.md provides the contributor guide. It lists prerequisites, build and test commands, project layout, pull request expectations, licensing terms for contributions, code of conduct, and security reporting requirements.

The repository requires DCO signoff on every non-merge commit. CONTRIBUTING.md documents the required git commit -s workflow, the pull request template includes a DCO
confirmation, and the repository has a dco GitHub Actions check that validates Signed-off-by trailers. The main branch ruleset requires the dco status check before
merge.

The primary branch main is protected by an active GitHub repository ruleset. Commits to main must pass strict required status checks before merge, including lint, test, govulncheck, and analyze-go, unless manually bypassed by repository administrators.

The protected main branch requires the test status check before changes are accepted. The test workflow runs the automated Go test suite through make coverage-check, and CI also runs lint, govulncheck, and CodeQL checks

The repository includes SECURITY-DESIGN.md, which documents system actors, main actions, trust boundaries, external interfaces, security controls, and the assessed high-impact risks for the released software.

The public documentation describes the released software interfaces: README.md documents install, TUI entry point, safety model, and release assets; USAGE.md documents CLI commands, global flags, examples, exit codes, runtime layout, and verification behavior; SECURITY.md documents release artifact interfaces and verification assets.

The project has performed security assessment through CodeQL SAST, govulncheck, OpenSSF Scorecard, branch/ruleset hardening, release-signing review, secret-scanning/ push-protection setup, and manual review of CI/CD token and signing-key exposure risks.

SECURITY.md includes a coordinated vulnerability disclosure policy with private reporting instructions, acknowledgement within 7 calendar days, initial assessment within 14 calendar days, coordinated fix/mitigation handling, and disclosure after a fix or mitigation is available.

SECURITY.md provides private vulnerability reporting channels, including the project security email webnestify@webnestify.cloud and GitHub private vulnerability
reporting when available on the repository Security tab.

No project vulnerabilities have been publicly disclosed for this repository yet. SECURITY.md states that confirmed vulnerabilities will be published through GitHub Security Advisories when appropriate and referenced from release notes or changelog entries after disclosure.