From 1f9c7cddf7d95b3f6bc557250195749fbe4fbc6b Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Mon, 27 Jul 2026 23:19:36 -0700 Subject: [PATCH 1/2] chore(release): prepare v0.3.96 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0836ff7c-06f5-4530-97fb-d69522abc79b --- .github/ISSUE_TEMPLATE/bug.yml | 2 +- AGENTS.md | 24 +-- CHANGELOG.md | 9 +- INSTALL.md | 10 +- README.md | 20 +-- SECURITY.md | 4 +- apps/desktop/PACKAGING.md | 2 +- apps/desktop/build/release-notes-author.md | 176 ++++++++------------- apps/desktop/package.json | 2 +- docs/src/architecture/system-overview.md | 2 +- docs/src/changelog.md | 10 +- docs/src/introduction.md | 8 +- docs/src/operations/ci.md | 14 +- docs/src/quick-start/install-run.md | 10 +- package-lock.json | 6 +- package.json | 2 +- scripts/release-metadata.test.mjs | 4 +- 17 files changed, 130 insertions(+), 175 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml index eeeaa87..a7565b5 100644 --- a/.github/ISSUE_TEMPLATE/bug.yml +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -15,7 +15,7 @@ body: attributes: label: ConfigForge version description: Include the tag, package version, or commit SHA. - placeholder: v0.3.95 + placeholder: v0.3.96 validations: required: true diff --git a/AGENTS.md b/AGENTS.md index 3f2b8c9..3454881 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -15,17 +15,17 @@ The renderer is built with Vite and routes through a typed IPC bridge (`window.c ### Current repository snapshot -The following release references were verified on 2026-07-27: +The following release references were verified on 2026-07-28: | Line | Reference | State | |---|---|---| -| `main` | `v0.3.95` | Current Windows/Linux tagged source. The matching GitHub release is a draft and unpublished. PR [#97](https://github.com/Azure/ConfigForge/pull/97) corrects documentation drift and PR [#100](https://github.com/Azure/ConfigForge/pull/100) replaces unreliable native hover titles with FluentUI tooltips on My Baselines status cells. | -| `mac-author-build` | `mac-v0.3.94-author.1` | Current author-only macOS tagged source. The matching GitHub release is a draft and unpublished. | +| `main` | `v0.3.96` | Current Windows/Linux tagged source. The matching GitHub release is a draft and unpublished. PR [#104](https://github.com/Azure/ConfigForge/pull/104) preserves the full WS2025 control sets and hardens Machine Configuration MOF export. | +| `mac-author-build` | `mac-v0.3.96-author.1` | Current author-only macOS tagged source. The matching GitHub release is a draft and unpublished. PR [#105](https://github.com/Azure/ConfigForge/pull/105) ports the same authoring/export changes. | On `mac-author-build`, the root package, desktop package, and lockfile records -use `0.3.94-author.1`. The current macOS Author tagged source is -`mac-v0.3.94-author.1`, and its matching GitHub release remains a draft and -unpublished. The Full-edition package versions are `0.3.95`; do not copy +use `0.3.96-author.1`. The current macOS Author tagged source is +`mac-v0.3.96-author.1`, and its matching GitHub release remains a draft and +unpublished. The Full-edition package versions are `0.3.96`; do not copy macOS package metadata to `main`. ### Current feature inventory @@ -116,12 +116,12 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag - The macOS tag must resolve to the exact final validated commit on `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and defaults to `Azure/ConfigForge`. -- The `0.3.94-author.1` release contract expects exactly these asset names: +- The `0.3.96-author.1` release contract expects exactly these asset names: | Asset | Exact name | |---|---| - | DMG | `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg` | - | Blockmap | `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg.blockmap` | + | DMG | `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg` | + | Blockmap | `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap` | | Update metadata | `latest-mac.yml` | | CycloneDX SBOM | `sbom-macos-author.cdx.json` | | SHA-256 manifest | `SHA256SUMS-macos-author.txt` | @@ -137,7 +137,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag gh workflow run "Release (macOS author)" ` --repo Azure/ConfigForge ` --ref main ` - -f release_tag=mac-v0.3.94-author.1 + -f release_tag=mac-v0.3.96-author.1 ``` - `--ref main` selects the reviewed workflow definition, not the source to @@ -443,9 +443,9 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann errors, the desktop build, and a production audit with 0 vulnerabilities. - Historical `0.3.93-author.1` and `0.3.93-author.2` validation records are superseded; their tags/releases no longer exist. Use the current - `mac-v0.3.94-author.1` unpublished draft release metadata and current GitHub + `mac-v0.3.96-author.1` unpublished draft release metadata and current GitHub checks as the authority for macOS Author build and asset status. -- The current macOS Author tagged source is `mac-v0.3.94-author.1`, with an +- The current macOS Author tagged source is `mac-v0.3.96-author.1`, with an unpublished draft release. Use current GitHub checks and release metadata as the authority for build and asset status rather than recording a merge SHA or workflow run here. diff --git a/CHANGELOG.md b/CHANGELOG.md index a304030..801f3d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,9 @@ # Changelog -## Unreleased +## [0.3.96] - 2026-07-28 + +> `v0.3.96` is the current Windows/Linux tagged source. Its matching GitHub +> release remains a draft and unpublished. ### Fixed @@ -18,8 +21,8 @@ ## [0.3.95] - 2026-07-27 -> `v0.3.95` is the current Windows/Linux tagged source. Its matching GitHub -> release remains a draft and is unpublished. +> `v0.3.95` is the prior Windows/Linux tagged source. Its matching GitHub +> release was an unpublished draft. ### Fixed diff --git a/INSTALL.md b/INSTALL.md index ada0f33..e6070e5 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -8,11 +8,11 @@ ConfigForge has two editions: and Audit Pack export are available. Device Deploy, Audit, and Revert are intentionally omitted. -The current Windows/Linux tagged source is `v0.3.95`, and its matching GitHub +The current Windows/Linux tagged source is `v0.3.96`, and its matching GitHub release is a draft and unpublished. The current macOS Author tagged source is -`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and -unpublished. The package versions are `0.3.95` for the Full edition and -`0.3.94-author.1` for the macOS Author edition. +`mac-v0.3.96-author.1`, and its matching GitHub release is also a draft and +unpublished. The package versions are `0.3.96` for the Full edition and +`0.3.96-author.1` for the macOS Author edition. ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source. @@ -128,7 +128,7 @@ later). The release contains an ARM64-only binary. It is not an x64 or universal build and does not support Intel Macs. Rosetta does not provide ARM64-on-Intel compatibility. -The current macOS Author tagged source is `mac-v0.3.94-author.1`. Its matching +The current macOS Author tagged source is `mac-v0.3.96-author.1`. Its matching GitHub release is a draft and is not available from the public [Azure/ConfigForge releases](https://github.com/Azure/ConfigForge/releases) page until a maintainer publishes it. Users can build the tagged source by diff --git a/README.md b/README.md index 919a404..2df3203 100644 --- a/README.md +++ b/README.md @@ -6,11 +6,11 @@ > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps. -The current Windows/Linux tagged source is `v0.3.95`, and its matching GitHub +The current Windows/Linux tagged source is `v0.3.96`, and its matching GitHub release is a draft and unpublished. The current macOS Author tagged source is -`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and -unpublished. The package versions are `0.3.95` for the Full edition and -`0.3.94-author.1` for the macOS Author edition. +`mac-v0.3.96-author.1`, and its matching GitHub release is also a draft and +unpublished. The package versions are `0.3.96` for the Full edition and +`0.3.96-author.1` for the macOS Author edition. ## What it looks like @@ -171,7 +171,7 @@ is not a universal binary. - **[`SUPPORT.md`](./SUPPORT.md)** and **[`SECURITY.md`](./SECURITY.md)**: best-effort support boundaries and private vulnerability reporting. - **[`apps/desktop/src/design/PLATFORM.md`](./apps/desktop/src/design/PLATFORM.md)**: platform-specific UX rules (Windows Mica + custom titlebar, Linux native frame, etc.). - **[`CHANGELOG.md`](./CHANGELOG.md)**: per-release notes. The current macOS - Author tagged source is `mac-v0.3.94-author.1`; its matching release is a + Author tagged source is `mac-v0.3.96-author.1`; its matching release is a draft and unpublished. - **[`docs/src/SUMMARY.md`](./docs/src/SUMMARY.md)**: documentation source for Quick Start, User Guide, Architecture, API Reference, and Operations. The @@ -199,11 +199,13 @@ is not a universal binary. | Version | Highlights | |---|---| -| **0.3.95** (current Windows/Linux tagged source; draft unpublished) | Replaces unreliable native hover titles with FluentUI tooltips on My Baselines status cells (keyboard accessible, ARIA-exposed multiline details) in PR #100; corrects documentation architecture and release-state drift in PR #97 | +| **0.3.96** (current Windows/Linux tagged source; draft unpublished) | Preserves all 320/321/296 WS2025 controls while fixing Registry/CSP contracts and CEL compliance, and hardens Machine Configuration MOF export in PR #104 | +| **0.3.96-author.1** (current macOS tagged source; draft unpublished) | Ports the same WS2025 authoring and global MOF export fixes to the author-only macOS line in PR #105 | +| **0.3.95** (prior Windows/Linux draft) | Replaces unreliable native hover titles with FluentUI tooltips on My Baselines status cells (keyboard accessible, ARIA-exposed multiline details) in PR #100; corrects documentation architecture and release-state drift in PR #97 | | **0.3.94** (prior Full edition) | Excludes CIS benchmark source data from public installers, publishes the public licensing/privacy/support/security policy surface, patches dev-only `brace-expansion` 5.x, and refreshes nine README screenshots with synthetic benchmark content in PR #89 | -| **0.3.94-author.1** (current macOS tagged source; draft unpublished) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations | -| **0.3.93-author.2** (historical macOS source milestone; no current tag or release) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83/#84. Historical workflow evidence is superseded by the current `mac-v0.3.94-author.1` draft release metadata. | -| **0.3.93-author.1** (historical macOS source milestone; no current tag or release) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77. Historical workflow evidence is superseded by the current `mac-v0.3.94-author.1` draft release metadata. | +| **0.3.94-author.1** (prior macOS draft) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations | +| **0.3.93-author.2** (historical macOS source milestone; no current tag or release) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83/#84. Historical workflow evidence is superseded by the current `mac-v0.3.96-author.1` draft release metadata. | +| **0.3.93-author.1** (historical macOS source milestone; no current tag or release) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77. Historical workflow evidence is superseded by the current `mac-v0.3.96-author.1` draft release metadata. | | **0.3.93** (prior Full edition) | Adds nested Enter/Tab editing and repairs standalone Windows Server 2025 audits, CIS mapping, and Matrix Diff policy identity handling | | **0.3.92** | Patches the desktop updater, AppImage packager, PostCSS processor, and archive toolchain against newly disclosed vulnerabilities | | **0.3.91** | Shows stacked Test schema rules in Visual mode and enforces supported constraints on newly edited values | diff --git a/SECURITY.md b/SECURITY.md index 8110322..ec2a778 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged source lines. | Edition | Current version | Security updates | | --- | --- | --- | -| Full edition for Windows and Linux | `v0.3.95` | Supported tagged source; release remains a draft | -| macOS Author edition | `mac-v0.3.94-author.1` | Supported tagged source; release remains a draft | +| Full edition for Windows and Linux | `v0.3.96` | Supported tagged source; release remains a draft | +| macOS Author edition | `mac-v0.3.96-author.1` | Supported tagged source; release remains a draft | | Older versions | Earlier tags | Not supported | ## Security scope diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md index 4ed3f3b..8b4e046 100644 --- a/apps/desktop/PACKAGING.md +++ b/apps/desktop/PACKAGING.md @@ -9,7 +9,7 @@ > flavor lives on the `mac-author-build` branch and uses its own > `electron-builder.author.yml`. > -> **Current through v0.3.95:** the release pipeline generates a +> **Current through v0.3.96:** the release pipeline generates a > CycloneDX SBOM per platform, enforces > `npm audit --omit=dev --audit-level=high` as a release gate, > pins `electron-builder` invocation via `npx --no-install`, and diff --git a/apps/desktop/build/release-notes-author.md b/apps/desktop/build/release-notes-author.md index 62e7272..dd7b4ca 100644 --- a/apps/desktop/build/release-notes-author.md +++ b/apps/desktop/build/release-notes-author.md @@ -1,100 +1,55 @@ -# ConfigForge Author 0.3.94-author.1 - macOS - -> **Release state: draft and unpublished.** -> `mac-v0.3.94-author.1` is the current macOS Author tagged source. The -> matching GitHub release remains a draft until a maintainer approves -> publication. Current GitHub checks and release metadata are the authority -> for build and asset status. - -This release improves public-source readiness, refreshes shared documentation -screenshots with synthetic benchmark content, and updates one dev-only -dependency. It remains author-only: device deployment, device audit, -enforcement, revert, elevation, OSConfig CLI health, and audit-results storage -are not included. - -## Security update - -- Update dev-only `brace-expansion` 5.x from 5.0.7 to 5.0.8 for - [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg) - and CVE-2026-14257. -- Preserve the exact public npm registry URL and integrity metadata reviewed - in PR [#86](https://github.com/Azure/ConfigForge/pull/86). -- Keep every other macOS dependency and version stream unchanged. The updated - package is used by build and test tooling and is not bundled in the app. - -## Public-source readiness - -- Align licensing, privacy, security reporting, best-effort support, - contribution templates, repository ownership, and release guidance through - PRs [#90](https://github.com/Azure/ConfigForge/pull/90), - [#92](https://github.com/Azure/ConfigForge/pull/92), and - [#93](https://github.com/Azure/ConfigForge/pull/93). -- Run a dependency-free public-package guard before packaging. The guard - rejects licensed CIS assets, unsafe CIS builder filters, and non-public npm - registry URLs. -- Keep maintainer, branch, and release guidance in existing documentation. - This release does not add a standalone governance file. - -## Synthetic documentation screenshots - -- Port the exact nine reviewed screenshot PNGs from PR - [#94](https://github.com/Azure/ConfigForge/pull/94). -- Use synthetic **Industry Benchmark** content in Benchmark Mapping and CIS - Diff examples. -- Commit no CIS benchmark data, generated benchmark catalog, or screenshot - tooling. - -The screenshots are shared documentation assets. They do not change the -macOS Author capability set. - -## Authoring parity - -- **Complete New Baseline setup:** create a blank Windows or Linux baseline, - use a starter template, choose a Microsoft Baseline in place, load from a - public URL, or import a local `.osc.yaml`, `.json`, `.csv`, or binary - `.xlsx` file. -- **Localized My Baselines catalog:** search and filter localized catalog - content, see Date Modified in the local calendar, and keep multiple - baselines open in persistent tabs. -- **Selection-aware Diff:** exactly two selected baselines open preselected in - Pairwise; three through ten open preselected in Matrix. -- **Safer workspaces:** unsaved changes prompt before a tab closes or - navigation leaves the editor. -- **Persistent views:** each baseline remembers Code or Visual view, and - read-only Code view explains how to enter editing. -- **Current Benchmark Mapping setup:** shared headings and localized guidance - replace the legacy setup copy. - -## Nested multi-value navigation - -PR #76 adds these behaviors on `main`, and PR #77 carries them to the current -macOS author line: - -- Enter commits the current nested value and moves down. -- Enter on the final nested value appends and focuses a new value. -- Tab commits and moves to the cell on the right. -- Empty arrays create a focusable value when navigation reaches them. -- Invalid drafts retain focus and do not mutate the manifest. -- Shift+Enter remains a newline for structured nested values. - -Dependency-free local validation covers package and lockfile JSON, the -public-package guard and its Node.js tests, documentation references, -forbidden files, public registry URLs, and Git whitespace checks. GitHub CI is -the authority for npm-backed lint, Vitest, build, audit, Playwright, and -release-asset status. +# ConfigForge Author 0.3.96-author.1 - macOS + +> **Release state: draft and unpublished.** `mac-v0.3.96-author.1` is the +> current macOS Author tagged source. Its matching GitHub release remains an +> unpublished draft until a maintainer verifies the five expected assets and +> approves publication. + +This release preserves the complete Windows Server 2025 baseline catalog and +hardens Machine Configuration MOF export. It remains an author-only Apple +Silicon build and does not add device deployment, device audit, enforcement, +revert, elevation, OSConfig CLI health, or audit-results storage. + +## Windows Server 2025 baseline rebuild + +- Preserve every shipped control and its ordering: + - Member Server: 320 resources + - Domain Controller: 321 resources + - Workgroup Member: 296 resources +- Use canonical `REG_*` Registry types and colon-qualified hive paths. +- Replace five CSP controls with reviewed Registry-provider mappings. +- Keep five Policy CSP controls on writable `Config` paths instead of + read-only `Result` paths. +- Translate the existing compliance schemas to CEL expressions without + weakening ranges or dropping resources. +- Keep explicit desired values for the two Workgroup zero-valued Registry + controls so exported manifests remain remediating. + +## Machine Configuration MOF export + +- Apply the MOF conversion fix to every baseline exported by ConfigForge, not + only the WS2025 catalog. +- Emit `ModuleName = "Microsoft.OSConfig"` and a portable + `ModuleVersion = "0.0.0"` placeholder for package-time version resolution. +- Emit one shared correlation-group GUID plus canonical `Value`, `ValueName`, + and `ValueType` fields. +- Preserve empty-string desired values through the Microsoft.OSConfig fallback + path. +- Default the public packaging documentation to Audit while + Microsoft.OSConfig 1.3.11 retains its upstream remediation serialization + defect. ## Included authoring capabilities -- YAML, JSON, and Visual editing with live validation -- Typed, lossless Test and Group editing with exact QWord values -- Microsoft Baselines and local/URL/spreadsheet import +- YAML, JSON, MOF, CSV, and Visual editing with validation +- Microsoft Baselines and local, URL, CSV, JSON, YAML, and XLSX import - Pairwise, CIS, and Matrix Diff - User-supplied Benchmark Mapping data - History and rationale capture - Audit Pack PDF and Markdown export -Audit Pack generation is an authoring/export feature. It does not run a device -audit. +Audit Pack generation is an authoring and export feature. It does not perform +a device audit. ## Author-only boundary @@ -106,43 +61,36 @@ The macOS preload intentionally omits: No `oscfg` binary or device-operation surface is included. -## Architecture: Apple Silicon ARM64 only +## Architecture -This DMG contains an ARM64 Electron and Node.js binary for Apple Silicon Macs -(M1 or later). It is not an x64 or universal build and does not support Intel -Macs. +The release targets Apple Silicon ARM64 Macs (M1 or later). It is not an x64 +or universal build and does not support Intel Macs. Builds are unsigned and +not notarized. -## First launch for unsigned builds +## Validation -The app is unsigned and not notarized. After copying **ConfigForge Author.app** -to `/Applications`, clear the browser-added quarantine attribute once: +- Main and mac WS2025 YAML structures are identical. +- Targeted MOF/catalog tests: 37 passed. +- Public packaging guard tests: 8 passed. +- PR #105 passed lint, full Vitest, Playwright Electron smoke, CodeQL, docs, + and policy checks. +- The matching Workgroup baseline applied successfully on Windows Server 2025 + and audited 296/296 compliant in the exact baseline state. -```bash -xattr -cr "/Applications/ConfigForge Author.app" -``` +## Expected draft release assets -If that command reports a permission error, use: +The macOS release workflow uses exactly these expected asset names for +`mac-v0.3.96-author.1`: -```bash -sudo xattr -rd com.apple.quarantine "/Applications/ConfigForge Author.app" -``` - -## Draft release asset contract - -The release workflow is configured to upload exactly: - -1. `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg` -2. `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg.blockmap` +1. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg` +2. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap` 3. `latest-mac.yml` 4. `sbom-macos-author.cdx.json` 5. `SHA256SUMS-macos-author.txt` -Use the draft GitHub release and current workflow checks to confirm actual -upload and verification status. - ## Contributors -PRs #86, #90, #92, #93, and #94 were contributed by +PRs #104 and #105 were contributed by [@ABMFST](https://github.com/ABMFST) with Copilot collaboration. ## Reporting issues diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 35aab93..d1b89a9 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -1,6 +1,6 @@ { "name": "@configforge/desktop", - "version": "0.3.95", + "version": "0.3.96", "private": true, "description": "ConfigForge \u2014 OSConfig Baseline Editing tool", "main": "./dist/electron/main.js", diff --git a/docs/src/architecture/system-overview.md b/docs/src/architecture/system-overview.md index a3b84c7..b993d78 100644 --- a/docs/src/architecture/system-overview.md +++ b/docs/src/architecture/system-overview.md @@ -1,6 +1,6 @@ # System overview -ConfigForge **0.3.95** is an Electron desktop app for authoring, validating, comparing, and deploying/auditing OSConfig manifests (`.osc.yaml`). The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package. +ConfigForge **0.3.96** is an Electron desktop app for authoring, validating, comparing, and deploying/auditing OSConfig manifests (`.osc.yaml`). The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package. There is no HTTP server, database, queue, or microservice layer in the current app. Renderer code calls the Electron preload bridge (`window.cfs.*`), the main process validates IPC payloads, and pure handlers in `packages/core` own filesystem and CLI operations. diff --git a/docs/src/changelog.md b/docs/src/changelog.md index f5af105..9b68e8d 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -4,7 +4,10 @@ A concise release history for ConfigForge. Newer entries use their release tags and state publication status explicitly; older entries summarize the foundational work by theme. -## Unreleased +## v0.3.96 — 2026-07-28 + +`v0.3.96` is the current Windows/Linux tagged source. Its matching GitHub +release remains a draft and unpublished. - **Windows Server 2025 baselines:** Rebuilt the full Member Server (320), Domain Controller (321), and Workgroup Member (296) profiles without losing @@ -17,9 +20,8 @@ foundational work by theme. ## v0.3.95 — 2026-07-27 -`v0.3.95` is the current Windows/Linux tagged source. Its matching GitHub -release remains a draft and is unpublished; this entry does not indicate -publication. +`v0.3.95` is the prior Windows/Linux tagged source. Its matching GitHub release +was an unpublished draft; this entry does not indicate publication. - **Fixed:** Replace unreliable native HTML hover titles with FluentUI tooltips on the My Baselines name, platform, validation, diff --git a/docs/src/introduction.md b/docs/src/introduction.md index 8fa5d17..cef9205 100644 --- a/docs/src/introduction.md +++ b/docs/src/introduction.md @@ -22,11 +22,11 @@ application** with two editions: and elevation methods under `system`) are intentionally omitted. Authors deploy later from the Full edition on Windows or Linux. -The current Windows/Linux tagged source is `v0.3.95`, and its matching GitHub +The current Windows/Linux tagged source is `v0.3.96`, and its matching GitHub release is a draft and unpublished. The current macOS Author tagged source is -`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and -unpublished. The package versions are `0.3.95` for the Full edition and -`0.3.94-author.1` for the macOS Author edition. +`mac-v0.3.96-author.1`, and its matching GitHub release is also a draft and +unpublished. The package versions are `0.3.96` for the Full edition and +`0.3.96-author.1` for the macOS Author edition. If you've ever maintained a security baseline by editing GPO templates, exporting Defender for Endpoint settings to a spreadsheet, or copy-pasting between half a dozen runbooks - this app is for you. diff --git a/docs/src/operations/ci.md b/docs/src/operations/ci.md index f09b3c3..c02fb98 100644 --- a/docs/src/operations/ci.md +++ b/docs/src/operations/ci.md @@ -13,7 +13,7 @@ ConfigForge uses GitHub Actions from `.github/workflows/`. The product is an Ele The Win/Linux Release workflow intentionally ignores hyphen-suffix tags (`!v*-*`). macOS Author releases use separate tags such as -`mac-v0.3.94-author.1`; dispatch the protected `main` workflow definition +`mac-v0.3.96-author.1`; dispatch the protected `main` workflow definition manually and let its checkout step select the immutable macOS tag. ## What `pr-check.yml` runs @@ -35,7 +35,7 @@ files; main PR #76 then passed its full suite plus 32 focused nested-navigation tests. Mac port PR #77 passed 79 focused tests and two isolated Playwright scenarios. Historical `0.3.93-author.1` and `0.3.93-author.2` validation records are superseded; their tags and releases no longer exist. The current -macOS Author tagged source is `mac-v0.3.94-author.1`, with an unpublished +macOS Author tagged source is `mac-v0.3.96-author.1`, with an unpublished draft release. Use its current GitHub checks and release metadata as the authority rather than pinning a workflow run in this document. @@ -71,7 +71,7 @@ the immutable macOS tag: gh workflow run "Release (macOS author)" \ --repo Azure/ConfigForge \ --ref main \ - -f release_tag=mac-v0.3.94-author.1 + -f release_tag=mac-v0.3.96-author.1 ``` The target draft release and tag must already exist. The workflow loads its @@ -79,16 +79,16 @@ definition from `main`, checks out `release_tag`, verifies that `HEAD` resolves to the tag, checks that tagged tree with the dependency-free public-asset guard from protected `main`, then builds with `electron-builder.author.yml`. -The `mac-v0.3.94-author.1` release contract expects exactly these assets: +The `mac-v0.3.96-author.1` release contract expects exactly these assets: -1. `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg` -2. `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg.blockmap` +1. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg` +2. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap` 3. `latest-mac.yml` 4. `sbom-macos-author.cdx.json` 5. `SHA256SUMS-macos-author.txt` The workflow refuses a published release and never publishes automatically. -For `mac-v0.3.94-author.1`, use the current GitHub checks and draft release as +For `mac-v0.3.96-author.1`, use the current GitHub checks and draft release as the authority for actual build and asset status. ## Linux runner notes diff --git a/docs/src/quick-start/install-run.md b/docs/src/quick-start/install-run.md index 789ce5a..14f632a 100644 --- a/docs/src/quick-start/install-run.md +++ b/docs/src/quick-start/install-run.md @@ -8,12 +8,12 @@ Benchmark Mapping, history, rationale, and Audit Pack export while omitting device operations. The native `oscfg` CLI is **not bundled** and is **not required** for authoring in either edition. -The current Windows/Linux tagged source is `v0.3.95`, and its matching GitHub +The current Windows/Linux tagged source is `v0.3.96`, and its matching GitHub release is a draft and unpublished. The current macOS Author tagged source is -`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and +`mac-v0.3.96-author.1`, and its matching GitHub release is also a draft and unpublished. Public downloads remain unavailable until a maintainer publishes -the releases. The package versions are `0.3.95` for the Full edition and -`0.3.94-author.1` for the macOS Author edition. +the releases. The package versions are `0.3.96` for the Full edition and +`0.3.96-author.1` for the macOS Author edition. ## Prerequisites @@ -32,7 +32,7 @@ cd ConfigForge > **Note:** `main` is the active Windows/Linux Full-edition line. On an Apple > Silicon Mac (M1 or later), users can build the -> `mac-v0.3.94-author.1` tagged source while the matching release remains +> `mac-v0.3.96-author.1` tagged source while the matching release remains > unpublished. Intel Macs and universal binaries are not supported. > macOS release builds are unsigned by design. Clear quarantine after > copying the app into Applications: diff --git a/package-lock.json b/package-lock.json index abc9511..f300546 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "configforge", - "version": "0.3.95", + "version": "0.3.96", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "configforge", - "version": "0.3.95", + "version": "0.3.96", "license": "MIT", "workspaces": [ "apps/*", @@ -33,7 +33,7 @@ }, "apps/desktop": { "name": "@configforge/desktop", - "version": "0.3.95", + "version": "0.3.96", "license": "MIT", "dependencies": { "@fluentui/react-components": "^9.73.8", diff --git a/package.json b/package.json index 9751e73..2e72cc7 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "configforge", - "version": "0.3.95", + "version": "0.3.96", "private": true, "license": "MIT", "description": "ConfigForge \u2014 Cross-platform Electron desktop app for OSConfig security baseline authoring", diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs index ec1356e..b6d5dc4 100644 --- a/scripts/release-metadata.test.mjs +++ b/scripts/release-metadata.test.mjs @@ -196,8 +196,8 @@ describe('public release metadata', () => { expect(contributing).toContain('creates immutable release tags and draft'); expect(support).toContain('The current repository maintainer is'); expect(readme).toContain('for ownership, active-branch, review, release, and cherry-pick guidance'); - expect(security).toContain('v0.3.95'); - expect(security).toContain('mac-v0.3.94-author.1'); + expect(security).toContain('v0.3.96'); + expect(security).toContain('mac-v0.3.96-author.1'); expect(security).toContain('Microsoft Security Response Center'); expect(security).toContain('Microsoft OSConfig project'); expect(support).toContain('best-effort basis'); From d4007283e33732d71b77a6ba97e98091033dc4b9 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Mon, 27 Jul 2026 23:31:55 -0700 Subject: [PATCH 2/2] docs(release): address v0.3.96 review feedback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0836ff7c-06f5-4530-97fb-d69522abc79b --- .github/workflows/release-mac.yml | 4 ++-- CHANGELOG.md | 4 ++-- apps/desktop/build/release-notes-author.md | 3 ++- docs/src/changelog.md | 9 ++++----- scripts/ship-mac.ps1 | 6 +++--- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release-mac.yml b/.github/workflows/release-mac.yml index 6a01aa8..6961137 100644 --- a/.github/workflows/release-mac.yml +++ b/.github/workflows/release-mac.yml @@ -11,7 +11,7 @@ name: Release (macOS author) # # Trigger: workflow_dispatch only. Run the workflow definition from protected `main`; # the checkout step below switches to and verifies the supplied immutable mac tag. -# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.94-author.1` +# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.96-author.1` # The protected main copy of the public packaging guard checks the tagged tree # before npm install or electron-builder runs. # @@ -143,7 +143,7 @@ jobs: ) > SHA256SUMS-macos-author.txt cat SHA256SUMS-macos-author.txt - # Attach to the existing draft release (e.g. mac-v0.3.94-author.1). + # Attach to the existing draft release (e.g. mac-v0.3.96-author.1). # `--clobber` overwrites if a re-run uploads the same filename. - name: Upload artifacts to draft release env: diff --git a/CHANGELOG.md b/CHANGELOG.md index 801f3d1..f208a0a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -40,8 +40,8 @@ ## [0.3.94] - 2026-07-26 -> `v0.3.94` is the current Windows/Linux tagged source. Its matching GitHub -> release remains a draft and is unpublished. +> `v0.3.94` is a prior Windows/Linux tagged source. Its matching GitHub +> release was an unpublished draft. ### Changed diff --git a/apps/desktop/build/release-notes-author.md b/apps/desktop/build/release-notes-author.md index dd7b4ca..349f954 100644 --- a/apps/desktop/build/release-notes-author.md +++ b/apps/desktop/build/release-notes-author.md @@ -41,7 +41,8 @@ revert, elevation, OSConfig CLI health, or audit-results storage. ## Included authoring capabilities -- YAML, JSON, MOF, CSV, and Visual editing with validation +- YAML, JSON, and Visual editing with validation +- MOF and CSV import/export for packaging and spreadsheet workflows - Microsoft Baselines and local, URL, CSV, JSON, YAML, and XLSX import - Pairwise, CIS, and Matrix Diff - User-supplied Benchmark Mapping data diff --git a/docs/src/changelog.md b/docs/src/changelog.md index 9b68e8d..60dd937 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -35,9 +35,8 @@ was an unpublished draft; this entry does not indicate publication. ## v0.3.94 — 2026-07-26 -`v0.3.94` is the current Windows/Linux tagged source. Its matching GitHub -release remains a draft and is unpublished; this entry does not indicate -publication. +`v0.3.94` is a prior Windows/Linux tagged source. Its matching GitHub release +was an unpublished draft; this entry does not indicate publication. - **Public packaging:** Exclude CIS benchmark source data from public installers while keeping Benchmark Mapping and CIS Diff available for @@ -62,8 +61,8 @@ publication. ## macOS Author mac-v0.3.94-author.1 — 2026-07-26 (draft, unpublished) -> `mac-v0.3.94-author.1` is the current macOS Author tagged source. Its -> matching GitHub release remains an unpublished draft. The author-only +> `mac-v0.3.94-author.1` is a prior macOS Author tagged source. Its +> matching GitHub release was an unpublished draft. The author-only > capability boundary is unchanged. ### Changed diff --git a/scripts/ship-mac.ps1 b/scripts/ship-mac.ps1 index d89285c..edc1985 100644 --- a/scripts/ship-mac.ps1 +++ b/scripts/ship-mac.ps1 @@ -21,7 +21,7 @@ because we forgot step 1 on an earlier author release and had to retry). .PARAMETER Tag - The release tag, e.g. "mac-v0.3.94-author.1". Must already exist as a + The release tag, e.g. "mac-v0.3.96-author.1". Must already exist as a git tag on the mac-author-build branch and be pushed to origin. .PARAMETER ReleaseTitle @@ -35,10 +35,10 @@ Optional path to a release-notes file. Cannot be combined with -Notes. .EXAMPLE - .\scripts\ship-mac.ps1 -Tag mac-v0.3.94-author.1 + .\scripts\ship-mac.ps1 -Tag mac-v0.3.96-author.1 .EXAMPLE - .\scripts\ship-mac.ps1 -Tag mac-v0.3.94-author.1 -NotesFile .\apps\desktop\build\release-notes-author.md + .\scripts\ship-mac.ps1 -Tag mac-v0.3.96-author.1 -NotesFile .\apps\desktop\build\release-notes-author.md #> [CmdletBinding()]