release-lab

Actively maintained: releases are cut from conventional commits at rehearsal cadence, Renovate and Dependabot keep every pin current, and the scheduled audits re-check settings drift, link liveness and the reproducibility of the latest release. Only the newest release is supported, per the organisation's security policy. https://github.com/monumental-archive/.github/blob/main/SECURITY.md

GitHub Issues, used for every individual issue. https://github.com/monumental-archive/release-lab/issues

No vulnerability report has been resolved in the last 12 months, so there is no reporter to credit. SECURITY.md commits to crediting reporters who do not request anonymity.

SECURITY.md documents the process end to end: private reporting through the repository's Security tab, acknowledgement within 14 days, what to expect afterwards, and the scope. https://github.com/monumental-archive/.github/blob/main/SECURITY.md

The gate is the coding standard in executable form, and it is specific per language: rustfmt's default style for Rust with clippy available locally, shellcheck for shell with bash pinned, actionlint and zizmor for workflow YAML, taplo for TOML, rumdl for Markdown, typos for spelling and committed for commit shape. https://github.com/monumental-archive/.github/blob/main/CONTRIBUTING.md

Automatically, in the gate: the belt's linters run in mise run ci on every pull request and fix:* siblings apply the machine-fixable subset. Style is never a review comment here.

Cargo honours the language's standard build variables (RUSTFLAGS, CARGO_TARGET_DIR, and CC/AR for build scripts); no wrapper overrides them.

cargo build without --release produces debugging information by default, and the release profile's debug setting is a one-line change in Cargo.toml.

No recursive build system is used: cargo builds the workspace as a single graph.

Proven on every release, not asserted: each artefact class is built twice independently in the publish workflow and the repro gate compares the two outputs bit for bit before anything is signed or attached, across rust-binary, oci-image, wasm-npm and pgrx-extension for every supported Postgres major. https://github.com/monumental-archive/.github/blob/main/docs/release.md

Every published class installs by the standard mechanism of its ecosystem: cargo install or the release tarball for the binary, npm install @monumental-archive/lab-wasm for the wasm package, docker pull ghcr.io/monumental-archive/release-lab for the image, and the per-major extension packages for Postgres. Nothing requires a bespoke installer.

The build honours the standard Rust conventions — CARGO_TARGET_DIR, RUSTFLAGS, CARGO_INSTALL_ROOT — and the release tarballs are relocatable, so an installer chooses its own prefix.

mise trust && mise install installs the pinned Rust toolchain and every tool the gate uses from the lockfile; mise run ci then runs exactly what CI runs. That is the whole developer setup. https://github.com/monumental-archive/release-lab/blob/main/README.md

Machine-readable and pinned throughout: Cargo.toml plus a committed Cargo.lock for crate dependencies, mise.toml plus mise.lock with per-platform checksums for tools, deny.toml for the licence and source policy, and renovate.json driving automated updates. https://github.com/monumental-archive/release-lab/blob/main/Cargo.toml

Continuously: cargo-deny and osv-scanner run in the gate over the lockfile, dependency-review runs on every pull request, Renovate and Dependabot open updates as advisories land, and the release path emits VEX decisions keyed by package@version for anything undecided. https://github.com/monumental-archive/.github/blob/main/docs/dependency-track.md

Every reused component is identified by exact version — Cargo.lock for crates, mise.lock for tools, full commit SHAs for actions — and updating is a Renovate pull request the gate verifies.

Dependencies are held current by automated updates rather than allowed to drift, and actionlint fails the gate on deprecated GitHub Actions features, so obsolescence surfaces as a red build.

gate.yml runs on every push and every pull request to main and reports as a required status check; beyond it, the release path itself runs end to end on every version — four artefact classes, five Postgres majors, real registries. https://github.com/monumental-archive/release-lab/blob/main/.github/workflows/gate.yml

Measured by the gate on every change, not asserted: mise run ci runs cargo-llvm-cov and the latest run reports 87.10% line and 86.57% region coverage, against a committed .coverage-floor of 69 that the ratchet only lets rise. Stated precisely, because the measurement has a boundary: it covers the crates whose tests run on the gate runner (lab-core, lab-wasm); lab-pg is excluded by COVERAGE_EXCLUDE because its pgrx tests need a live Postgres and run instead inside the extension class's own per-major containers during the release, and the lab-cli binary has no unit tests of its own — it is exercised end to end by the release path's binary smoke test. https://github.com/monumental-archive/release-lab/blob/main/.coverage-floor

CONTRIBUTING.md, 'Requirements for acceptable contributions' item 3, is the formal written policy: a change that adds or changes behaviour adds the check that holds it. https://github.com/monumental-archive/.github/blob/main/CONTRIBUTING.md

The policy is stated in the contributor-facing documentation itself: CONTRIBUTING.md, item 3 of 'Requirements for acceptable contributions'. https://github.com/monumental-archive/.github/blob/main/CONTRIBUTING.md

Implemented, not merely known: every workflow in this repository declares a minimal explicit permissions: block, the logic it calls is pinned to a full commit SHA of the governance repository, publishing is keyless via OIDC trusted publishing with no standing credentials, and each release is signed and attested through the organisation's separate signer identity, which never sees the bytes it signs.

Integrity everywhere is SHA-256 and signing is Sigstore's ECDSA P-256. No MD5 or SHA-1 is relied on as a security mechanism.

The software implements no cryptography and selects no algorithms; where cryptography is used it is Sigstore's and GitHub's.

The software stores no authentication credentials or private keys. Secrets live in GitHub environment and organisation secrets, never in files in the repository, and release signing uses ephemeral keys.

All network communication is HTTPS — GitHub APIs, tool downloads, registry publishing, transparency-log submission. No insecure protocol appears anywhere in the tree, and certificate verification is never disabled.

The software does not implement or configure TLS; it invokes tools (cargo, git, gh, curl) whose TLS versions are theirs.

Certificate verification is never disabled: there is no --insecure, -k, or GIT_SSL_NO_VERIFY anywhere in the tracked tree, so every HTTPS call made by the project verifies by default.

The software implements no TLS client of its own and sends no HTTP headers carrying private information.

Verified against the published release rather than asserted: v0.24.4 carries nine Sigstore evidence bundles (attestations-binaries, -image, -npm, -extensions and one per Postgres major) alongside checksums.txt, an SPDX SBOM and an OpenVEX document. Signing is keyless — Sigstore/Fulcio with a Rekor transparency-log entry — and is performed by the organisation's separate signer identity, which never sees the bytes. https://github.com/monumental-archive/release-lab/releases/tag/v0.24.4

Release tags are annotated tag objects signed with Sigstore keyless signing, and the signature travels in the tag object itself: v0.24.4 carries a PKCS#7 SIGNED MESSAGE whose Fulcio certificate binds it to the organisation's release workflow identity. GitHub reports such tags as unverified with reason no_user because the signer is a workflow identity rather than a GitHub account; the signature is present and checkable. https://github.com/monumental-archive/release-lab/tags

The fixture crates validate their inputs and are fuzzed for it: parse_marker is a libFuzzer target with a committed corpus, run under audit:fuzz and built in the gate by lint:fuzz-build. The workflow surface validates inputs against allowlists in the shared workflows this repository calls (the artifact classes: set, the publish stub shape checked by lint:release-stub).

Least-privilege permissions on every workflow; every uses: pinned to a full commit SHA; the toolchain pinned with per-platform checksums in mise.lock and Cargo dependencies locked; keyless publishing with no standing credentials; secret scanning with push protection enforced organisation-wide; releases immutable once published. Each mechanism is written up control by control, against the threat it answers, in docs/build-assessment.md. https://github.com/monumental-archive/.github/blob/main/docs/build-assessment.md

docs/release.md and docs/slsa-reference.md in the governance repository are the written assurance case for this pipeline, and the assessments walk each claim against its evidence. What this repository adds is the execution: the claims are demonstrated here at full width before they are relied on anywhere. https://github.com/monumental-archive/.github/blob/main/docs/slsa-reference.md

CodeQL is enforced organisation-wide for the languages in this repository, cargo-deny and osv-scanner match the dependency graph against advisory databases, and zizmor is a scanner specific to the other artefact here — GitHub Actions workflows — covering template injection, excessive permissions, credential persistence and unpinned actions.

No memory-unsafe language is used: the crates are safe Rust with no unsafe blocks in the tracked sources, which is why the fuzz targets build with --sanitizer none on the pinned stable toolchain — in safe Rust the failure class libFuzzer surfaces is the panic, not the buffer overwrite.