mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-31 21:37:08 -06:00
1fe689a7bf
* docs: add mdBook and security documentation foundation * docs: point book links at storytold/photocraft; scope the credits entry The book's repository/edit URLs and source links pointed at the contributor's fork. The credits entry now describes what this PR contributed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Brandon Thomas <echelon@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1.4 KiB
1.4 KiB
Release security
PhotoCraft's release workflow builds platform packages and a draft GitHub Release from the release branch. The authoritative process is docs/releasing.md.
Implemented workflow elements
- platform-specific signing/notarization steps exist for macOS and Windows;
- signing secrets are scoped through the GitHub
releaseenvironment; - release artifacts include
SHA256SUMS.txt; - the final release job receives
contents: write, while build jobs use narrower access; - artifacts remain in a draft release until a maintainer publishes them.
Signing is conditional. The workflow can produce unsigned artifacts when signing material is unavailable and emits warnings. Consumers and maintainers must verify the job summary and artifact signature rather than assuming every release is signed.
Future hardening
- generate a machine-readable SBOM for each release;
- publish provenance/attestations tied to the source commit and workflow;
- make signature state explicit in release metadata;
- verify checksums, signatures, notarization, and installer behavior before publication;
- review action pinning and release-tool provenance;
- document key rotation and compromise response.
Building, signing, drafting, publishing, and deploying are separate states. A successful build must not be reported as a published release.