.github

Least privilege is the default and the explicit setting: the repository baseline sets the workflow token to read-only permissions, and every workflow declares its own minimal permissions: block on top of that. A job that specifies nothing therefore gets read, not write. https://github.com/monumental-archive/.github/tree/main/settings

Every release is a unique semantic version, derived from conventional commits by git-cliff and tagged v<major>.<minor>.<patch> by the release App; the tag ruleset makes tags immutable, so a version identifier is never reused.

CHANGELOG.md is generated by git-cliff from conventional commits and the same descriptive log is attached to each GitHub release, so functional and security modifications are recorded per release. https://github.com/monumental-archive/.github/releases

Dependency ingestion is standardised: mise with an exact-version config and a lockfile carrying per-platform checksums for tools, and the language-native managers (cargo, npm) for consuming repositories. Preference is for aqua-backed tools so downloads carry checksums and attestations rather than running install scripts.

Each release carries a Sigstore evidence bundle and GitHub artifact attestations covering every published asset by cryptographic digest, and docs/runbook.md documents how a consumer verifies them. https://github.com/monumental-archive/.github/blob/main/docs/runbook.md

Documented in two places and deliberately so: docs/tooling-verdicts.md records how a dependency is selected — the priors a tool must meet to enter the belt, and the verdicts on tools considered and declined — and docs/dependency-track.md records how dependencies are obtained, pinned, monitored and triaged. https://github.com/monumental-archive/.github/blob/main/docs/tooling-verdicts.md

README.md and CONTRIBUTING.md give the whole sequence: mise trust && mise install brings every required tool at its pinned version from the lockfile, and mise run ci then runs exactly what CI runs. There are no separate libraries, frameworks or SDKs to install. https://github.com/monumental-archive/.github/blob/main/CONTRIBUTING.md

docs/continuity.md carries an asset table naming who holds each sensitive resource — organisation ownership, the tag-mint App key, registry accounts, the one standing token — and what happens to each if that person is unavailable. https://github.com/monumental-archive/.github/blob/main/docs/continuity.md

GOVERNANCE.md carries a 'Roles and responsibilities' table naming three roles - maintainer/owner, contributor, automation - and the responsibilities of each, and it is served from the organisation's .github repository as a default community health file so it applies to every repository that does not carry its own. Who holds the maintainer role is explicit: the @monumental-archive/owners team, which CODEOWNERS routes every review to. https://github.com/monumental-archive/.github/blob/main/GOVERNANCE.md#roles-and-responsibilities

CONTRIBUTING.md includes a 'Requirements for acceptable contributions' section: pull request only, a green mise run ci, Conventional Commits with imperative lowercase subjects under 72 columns, DCO sign-off, squash merge. https://github.com/monumental-archive/.github/blob/main/CONTRIBUTING.md

Every commit must carry a Developer Certificate of Origin 1.1 sign-off asserting legal authorisation. The commit-msg hook catches a missing trailer locally and lint:dco fails the gate, with no exemption list — automation signs off too.

The gate is a required status check on main under an organisation ruleset: a pull request cannot merge red, and direct pushes are blocked entirely, so no commit reaches the primary branch without its checks passing. https://github.com/monumental-archive/.github/blob/main/docs/rulesets.md

gate.yml runs the full automated suite — mise run ci, every belt check against every tracked file — on each pull request before it can be accepted, and it does so by self-applying the reusable workflow this project publishes. https://github.com/monumental-archive/.github/blob/main/.github/workflows/gate.yml

docs/release.md specifies the pipeline actor by actor and action by action — what each workflow does, which identity it runs as, what it is permitted to touch — and docs/build-track.md and docs/source-track.md carry the per-track designs. The capability boundary between caller code and the privileged identity is stated explicitly as a design rule. https://github.com/monumental-archive/.github/blob/main/docs/release.md

The external interfaces are the reusable workflows and the task contract: docs/runbook.md documents each workflow's inputs and the artifact classes with their required parameters, and workflow-templates/ ships a caller stub per workflow. https://github.com/monumental-archive/.github/blob/main/docs/runbook.md

docs/build-assessment.md and docs/source-assessment.md are written security assessments of this system: they walk the controls, name the most likely and impactful failure modes (untrusted caller code reaching a privileged signing identity, supply-chain substitution through unpinned dependencies, silent settings drift), and record which are mitigated and which are accepted. https://github.com/monumental-archive/.github/blob/main/docs/build-assessment.md

SECURITY.md is the coordinated disclosure policy and it states the timeframe: private reporting through the repository's Security tab, acknowledgement within 14 days, and what the reporter can expect afterwards. https://github.com/monumental-archive/.github/blob/main/SECURITY.md

GitHub private vulnerability reporting is enabled and is the documented channel in SECURITY.md, delivering the report directly to the security contact without public exposure. https://github.com/monumental-archive/.github/blob/main/SECURITY.md

Vulnerability data is published rather than held privately: resolved reports would be published as GitHub Security Advisories on the repository, and the dependency track already publishes machine-readable VEX decisions keyed by package and version for the advisories that touch this project's dependencies. No vulnerability in this project's own code has been discovered to date. https://github.com/monumental-archive/.github/blob/main/docs/dependency-track.md