From d79f0d93fe9c53d1e3627127659d83a5f6356551 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Mon, 27 Jul 2026 23:19:36 -0700 Subject: [PATCH] chore(release): prepare mac v0.3.96-author.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0836ff7c-06f5-4530-97fb-d69522abc79b --- .github/workflows/release-mac.yml | 4 +- AGENTS.md | 18 ++-- CHANGELOG.md | 10 +- INSTALL.md | 10 +- README.md | 14 +-- SECURITY.md | 4 +- apps/desktop/PACKAGING.md | 2 +- apps/desktop/build/release-notes-author.md | 107 ++++++++++----------- apps/desktop/package.json | 2 +- docs/src/architecture/system-overview.md | 2 +- docs/src/changelog.md | 10 +- docs/src/introduction.md | 6 +- docs/src/operations/ci.md | 14 +-- docs/src/quick-start/install-run.md | 8 +- package-lock.json | 6 +- package.json | 2 +- scripts/release-metadata.test.mjs | 4 +- scripts/ship-mac.ps1 | 6 +- 18 files changed, 117 insertions(+), 112 deletions(-) diff --git a/.github/workflows/release-mac.yml b/.github/workflows/release-mac.yml index 7d65abd..6961137 100644 --- a/.github/workflows/release-mac.yml +++ b/.github/workflows/release-mac.yml @@ -11,7 +11,7 @@ name: Release (macOS author) # # Trigger: workflow_dispatch only. Run the workflow definition from protected `main`; # the checkout step below switches to and verifies the supplied immutable mac tag. -# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.95-author.1` +# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.96-author.1` # The protected main copy of the public packaging guard checks the tagged tree # before npm install or electron-builder runs. # @@ -143,7 +143,7 @@ jobs: ) > SHA256SUMS-macos-author.txt cat SHA256SUMS-macos-author.txt - # Attach to the existing draft release (e.g. mac-v0.3.95-author.1). + # Attach to the existing draft release (e.g. mac-v0.3.96-author.1). # `--clobber` overwrites if a re-run uploads the same filename. - name: Upload artifacts to draft release env: diff --git a/AGENTS.md b/AGENTS.md index 2418426..929a876 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -19,12 +19,12 @@ The following release references describe the current tagged source lines: | Line | Reference | State | |---|---|---| -| `main` | `v0.3.95` | Current Full-edition Windows/Linux tagged source (PR [#102](https://github.com/Azure/ConfigForge/pull/102) merged at `6c593c0`). Its matching GitHub release remains an unpublished draft. | -| `mac-author-build` | `mac-v0.3.95-author.1` | Current author-only macOS tagged source. Its matching GitHub release remains an unpublished draft. PR [#99](https://github.com/Azure/ConfigForge/pull/99) ports documentation-accuracy corrections; PR [#101](https://github.com/Azure/ConfigForge/pull/101) replaces unreliable native HTML hover titles with FluentUI tooltips on My Baselines status cells. | +| `main` | `v0.3.96` | Current Full-edition Windows/Linux tagged source (PR [#104](https://github.com/Azure/ConfigForge/pull/104) merged at `b986ab8`). Its matching GitHub release remains an unpublished draft. | +| `mac-author-build` | `mac-v0.3.96-author.1` | Current author-only macOS tagged source. Its matching GitHub release remains an unpublished draft. PR [#105](https://github.com/Azure/ConfigForge/pull/105) ports the full WS2025 control-preservation and global MOF export fixes. | On `mac-author-build`, the root package, desktop package, and matching lockfile -records use `0.3.95-author.1`. This release carries no dependency changes from -the prior macOS line. The package version on `main` is `0.3.95`; do not copy +records use `0.3.96-author.1`. This release carries no dependency changes from +the prior macOS line. The package version on `main` is `0.3.96`; do not copy macOS package metadata to `main`. The prior annotated tag `mac-v0.3.94-author.1` resolves to @@ -121,15 +121,15 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag - The macOS tag must resolve to the exact final validated commit on `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and defaults to `Azure/ConfigForge`. -- The current macOS Author tagged source `mac-v0.3.95-author.1` expects +- The current macOS Author tagged source `mac-v0.3.96-author.1` expects these asset names. Its matching GitHub release remains an unpublished draft; this documentation does not assert asset availability or publication: | Asset | Exact name | |---|---| - | DMG | `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg` | - | Blockmap | `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg.blockmap` | + | DMG | `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg` | + | Blockmap | `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap` | | Update metadata | `latest-mac.yml` | | CycloneDX SBOM | `sbom-macos-author.cdx.json` | | SHA-256 manifest | `SHA256SUMS-macos-author.txt` | @@ -145,7 +145,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag gh workflow run "Release (macOS author)" ` --repo Azure/ConfigForge ` --ref main ` - -f release_tag=mac-v0.3.95-author.1 + -f release_tag=mac-v0.3.96-author.1 ``` - `--ref main` selects the reviewed workflow definition, not the source to @@ -454,7 +454,7 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann workflow run [#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418), but that release remains a draft and unpublished. -- The current macOS Author tagged source is `mac-v0.3.95-author.1`. Its +- The current macOS Author tagged source is `mac-v0.3.96-author.1`. Its matching GitHub release remains an unpublished draft; use current GitHub checks and release metadata as the authority for build and asset status rather than recording a merge SHA or workflow run here. diff --git a/CHANGELOG.md b/CHANGELOG.md index 2da351f..796e7d4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,10 @@ # Changelog -## Unreleased +## [0.3.96-author.1] - 2026-07-28 + +> `mac-v0.3.96-author.1` is the current macOS Author tagged source. Its +> matching GitHub release remains an unpublished draft. The author-only +> capability boundary is unchanged. ### Fixed @@ -18,8 +22,8 @@ ## [0.3.95-author.1] - 2026-07-27 -> `mac-v0.3.95-author.1` is the current macOS Author tagged source. Its -> matching GitHub release remains an unpublished draft. This entry does not +> `mac-v0.3.95-author.1` is the prior macOS Author tagged source. Its +> matching GitHub release was an unpublished draft. This entry does not > indicate publication or assert asset availability. The author-only > capability boundary is unchanged: device deploy, audit, enforce, revert, > elevation, health, and audit-results storage remain excluded. diff --git a/INSTALL.md b/INSTALL.md index 362a972..64b1f80 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -8,11 +8,11 @@ ConfigForge has two editions: and Audit Pack export are available. Device Deploy, Audit, and Revert are intentionally omitted. -The current Windows/Linux Full-edition tagged source is `v0.3.95`. The -current macOS Author tagged source is `mac-v0.3.95-author.1`. Both matching +The current Windows/Linux Full-edition tagged source is `v0.3.96`. The +current macOS Author tagged source is `mac-v0.3.96-author.1`. Both matching GitHub releases remain unpublished drafts. The Full-edition package version -on `main` is `0.3.95`; the macOS Author package version is -`0.3.95-author.1`. +on `main` is `0.3.96`; the macOS Author package version is +`0.3.96-author.1`. ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source. @@ -128,7 +128,7 @@ later). The release contains an ARM64-only binary. It is not an x64 or universal build and does not support Intel Macs. Rosetta does not provide ARM64-on-Intel compatibility. -The current macOS Author source tag is `mac-v0.3.95-author.1`. Its matching +The current macOS Author source tag is `mac-v0.3.96-author.1`. Its matching GitHub release remains an unpublished draft and must stay draft-only until a maintainer completes validation and approves publication. Users can build the tagged source by following the instructions in the diff --git a/README.md b/README.md index a6b7bb3..fb5499f 100644 --- a/README.md +++ b/README.md @@ -6,10 +6,10 @@ > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps. -The current Windows/Linux Full-edition tagged source is `v0.3.95`. The -current macOS Author tagged source is `mac-v0.3.95-author.1`. Both matching +The current Windows/Linux Full-edition tagged source is `v0.3.96`. The +current macOS Author tagged source is `mac-v0.3.96-author.1`. Both matching GitHub releases remain unpublished drafts. The Full-edition package version -on `main` is `0.3.95`; the macOS Author package version is `0.3.95-author.1`. +on `main` is `0.3.96`; the macOS Author package version is `0.3.96-author.1`. The macOS Author release ports applicable documentation-accuracy corrections from `main` PR [#97](https://github.com/Azure/ConfigForge/pull/97) via PR @@ -180,7 +180,7 @@ is not a universal binary. - **[`SUPPORT.md`](./SUPPORT.md)** and **[`SECURITY.md`](./SECURITY.md)**: best-effort support boundaries and private vulnerability reporting. - **[`apps/desktop/src/design/PLATFORM.md`](./apps/desktop/src/design/PLATFORM.md)**: platform-specific UX rules (Windows Mica + custom titlebar, Linux native frame, etc.). - **[`CHANGELOG.md`](./CHANGELOG.md)**: per-release notes. The current macOS - Author line is tagged as `mac-v0.3.95-author.1`; its release is an + Author line is tagged as `mac-v0.3.96-author.1`; its release is an unpublished draft. - **[`docs/src/SUMMARY.md`](./docs/src/SUMMARY.md)**: documentation source for Quick Start, User Guide, Architecture, API Reference, and Operations. The @@ -208,8 +208,10 @@ is not a universal binary. | Version | Highlights | |---|---| -| **0.3.95-author.1** (current macOS tagged source; draft unpublished) | Fixes unreliable My Baselines status tooltips by replacing native HTML hover titles with FluentUI tooltips (PR #101), and ports documentation-accuracy corrections from main PR #97 (PR #99). | -| **0.3.95** (current Windows/Linux tagged source; draft unpublished) | Replaces unreliable native HTML hover titles with FluentUI tooltips on My Baselines status cells (PR #100) and corrects architecture/CI/release-state documentation drift (PR #97). | +| **0.3.96-author.1** (current macOS tagged source; draft unpublished) | Ports the full 320/321/296 WS2025 control-preservation work and global Machine Configuration MOF export fixes from main PR #104 through PR #105. | +| **0.3.96** (current Windows/Linux tagged source; draft unpublished) | Preserves every WS2025 control while fixing Registry/CSP contracts and CEL compliance, and hardens Machine Configuration MOF export in PR #104. | +| **0.3.95-author.1** (prior macOS draft, unpublished) | Fixes unreliable My Baselines status tooltips by replacing native HTML hover titles with FluentUI tooltips (PR #101), and ports documentation-accuracy corrections from main PR #97 (PR #99). | +| **0.3.95** (prior Windows/Linux draft, unpublished) | Replaces unreliable My Baselines status tooltips with FluentUI tooltips (PR #100) and corrects documentation drift (PR #97). | | **0.3.94-author.1** (prior macOS draft, unpublished) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations. | | **0.3.94** (prior Windows/Linux tagged source) | Excludes CIS benchmark source data from public installers, publishes the public licensing/privacy/support/security policy surface, patches dev-only `brace-expansion` 5.x, and refreshes nine README screenshots with synthetic benchmark content in PR #89. | | **0.3.93-author.2** (prior macOS draft, unpublished) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83; PR #84 prepares the immutable tag. Workflow run #30186678580 verified all five assets. | diff --git a/SECURITY.md b/SECURITY.md index 9aa1954..6bdc229 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged release lines. | Edition | Current version | Security updates | | --- | --- | --- | -| Full edition for Windows and Linux | `v0.3.95` | Supported tagged source; release remains a draft | -| macOS Author edition | `mac-v0.3.95-author.1` | Supported tagged source; release remains a draft | +| Full edition for Windows and Linux | `v0.3.96` | Supported tagged source; release remains a draft | +| macOS Author edition | `mac-v0.3.96-author.1` | Supported tagged source; release remains a draft | | Older versions | Earlier tags | Not supported | ## Security scope diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md index 585feb7..0a4ade3 100644 --- a/apps/desktop/PACKAGING.md +++ b/apps/desktop/PACKAGING.md @@ -9,7 +9,7 @@ > flavor lives on the `mac-author-build` branch and uses its own > `electron-builder.author.yml`. > -> **Current through v0.3.95-author.1:** the release pipeline +> **Current through v0.3.96-author.1:** the release pipeline > generates a CycloneDX SBOM per platform, enforces > `npm audit --omit=dev --audit-level=high` as a release gate, > pins `electron-builder` invocation via `npx --no-install`, and diff --git a/apps/desktop/build/release-notes-author.md b/apps/desktop/build/release-notes-author.md index 0b082bf..dd7b4ca 100644 --- a/apps/desktop/build/release-notes-author.md +++ b/apps/desktop/build/release-notes-author.md @@ -1,47 +1,47 @@ -# ConfigForge Author 0.3.95-author.1 - macOS +# ConfigForge Author 0.3.96-author.1 - macOS -> **Release state: draft and unpublished.** `mac-v0.3.95-author.1` is the +> **Release state: draft and unpublished.** `mac-v0.3.96-author.1` is the > current macOS Author tagged source. Its matching GitHub release remains an -> unpublished draft until a maintainer completes validation and approves -> publication. The expected asset names are listed below; this document does -> not assert that the assets have already been uploaded or that the release -> has been published. - -This release fixes unreliable My Baselines status tooltips and ports -documentation-accuracy corrections. It remains an author-only Apple Silicon -build. It does not add device deployment, device audit, enforcement, revert, -elevation, OSConfig CLI health, or audit-results storage. - -## Fixed: reliable My Baselines status tooltips - -- Replace unreliable native HTML `title` hover tooltips with FluentUI - `Tooltip` on the baseline name, platform, validation, compliance/Not - Audited, and modified-date cells in the My Baselines table. -- Preserve multiline validation details through a stable - `aria-describedby` target instead of relying on OS-rendered native tooltips. -- Keep the mac compliance cell intentionally non-clickable — it stays a - non-interactive `` with the existing gray "not audited" styling, now - wrapped only in `Tooltip`. No button, click handler, or route navigation - was added. -- Preserve the accessible ARIA shape: no extra table tab stops are - introduced by the tooltip triggers. -- See PR [#101](https://github.com/Azure/ConfigForge/pull/101), which ports - the reviewed main PR [#100](https://github.com/Azure/ConfigForge/pull/100) - fix to the mac-specific table layout. - -## Documentation accuracy - -- Port the applicable documentation-accuracy corrections from main PR - [#97](https://github.com/Azure/ConfigForge/pull/97) via PR - [#99](https://github.com/Azure/ConfigForge/pull/99), including corrected - IPC surface, symbol/path references, and third-party notice licensing. -- Keep the macOS Author version stream and release references unaffected by - the documentation port; no package, version, or workflow files changed in - PR #99. +> unpublished draft until a maintainer verifies the five expected assets and +> approves publication. + +This release preserves the complete Windows Server 2025 baseline catalog and +hardens Machine Configuration MOF export. It remains an author-only Apple +Silicon build and does not add device deployment, device audit, enforcement, +revert, elevation, OSConfig CLI health, or audit-results storage. + +## Windows Server 2025 baseline rebuild + +- Preserve every shipped control and its ordering: + - Member Server: 320 resources + - Domain Controller: 321 resources + - Workgroup Member: 296 resources +- Use canonical `REG_*` Registry types and colon-qualified hive paths. +- Replace five CSP controls with reviewed Registry-provider mappings. +- Keep five Policy CSP controls on writable `Config` paths instead of + read-only `Result` paths. +- Translate the existing compliance schemas to CEL expressions without + weakening ranges or dropping resources. +- Keep explicit desired values for the two Workgroup zero-valued Registry + controls so exported manifests remain remediating. + +## Machine Configuration MOF export + +- Apply the MOF conversion fix to every baseline exported by ConfigForge, not + only the WS2025 catalog. +- Emit `ModuleName = "Microsoft.OSConfig"` and a portable + `ModuleVersion = "0.0.0"` placeholder for package-time version resolution. +- Emit one shared correlation-group GUID plus canonical `Value`, `ValueName`, + and `ValueType` fields. +- Preserve empty-string desired values through the Microsoft.OSConfig fallback + path. +- Default the public packaging documentation to Audit while + Microsoft.OSConfig 1.3.11 retains its upstream remediation serialization + defect. ## Included authoring capabilities -- YAML, JSON, and Visual editing with validation +- YAML, JSON, MOF, CSV, and Visual editing with validation - Microsoft Baselines and local, URL, CSV, JSON, YAML, and XLSX import - Pairwise, CIS, and Matrix Diff - User-supplied Benchmark Mapping data @@ -67,35 +67,30 @@ The release targets Apple Silicon ARM64 Macs (M1 or later). It is not an x64 or universal build and does not support Intel Macs. Builds are unsigned and not notarized. -## Validation policy +## Validation -Release preparation uses these dependency-free local checks: - -- Parse and compare package and lockfile JSON. -- Verify the public-package guard and its Node.js tests. -- Check documentation references, forbidden files, public registry URLs, and - exact screenshot scope. -- Run Git whitespace and diff-scope checks. - -GitHub CI is authoritative for npm-backed lint, Vitest, build, audit, and -Playwright validation. Publication requires successful CI, a completed -packaging build, and verification of the five expected assets before the -draft release is published. +- Main and mac WS2025 YAML structures are identical. +- Targeted MOF/catalog tests: 37 passed. +- Public packaging guard tests: 8 passed. +- PR #105 passed lint, full Vitest, Playwright Electron smoke, CodeQL, docs, + and policy checks. +- The matching Workgroup baseline applied successfully on Windows Server 2025 + and audited 296/296 compliant in the exact baseline state. ## Expected draft release assets The macOS release workflow uses exactly these expected asset names for -`mac-v0.3.95-author.1`: +`mac-v0.3.96-author.1`: -1. `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg` -2. `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg.blockmap` +1. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg` +2. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap` 3. `latest-mac.yml` 4. `sbom-macos-author.cdx.json` 5. `SHA256SUMS-macos-author.txt` ## Contributors -PRs #99 and #101 were contributed by +PRs #104 and #105 were contributed by [@ABMFST](https://github.com/ABMFST) with Copilot collaboration. ## Reporting issues diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 6d4b799..d2d49ee 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -1,6 +1,6 @@ { "name": "@configforge/desktop", - "version": "0.3.95-author.1", + "version": "0.3.96-author.1", "private": true, "description": "ConfigForge \u2014 OSConfig Baseline Editing tool", "main": "./dist/electron/main.js", diff --git a/docs/src/architecture/system-overview.md b/docs/src/architecture/system-overview.md index 884e34b..c15ac04 100644 --- a/docs/src/architecture/system-overview.md +++ b/docs/src/architecture/system-overview.md @@ -1,6 +1,6 @@ # System overview -ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.95`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.95-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package. +ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.96`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.96-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package. There is no HTTP server, database, queue, or microservice layer in the current app. Renderer code calls the Electron preload bridge (`window.cfs.*`), the main process validates IPC payloads, and pure handlers in `packages/core` own filesystem and CLI operations. diff --git a/docs/src/changelog.md b/docs/src/changelog.md index afbe66c..e1ab6e2 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -3,7 +3,11 @@ A concise release history for ConfigForge. Newer entries use the shipped semver tag; older entries summarize the foundational work by theme. -## Unreleased +## macOS Author v0.3.96-author.1 — 2026-07-28 + +`mac-v0.3.96-author.1` is the current macOS Author tagged source. Its matching +GitHub release remains an unpublished draft. The author-only capability +boundary is unchanged. - **Windows Server 2025 baselines:** Rebuilt the full Member Server (320), Domain Controller (321), and Workgroup Member (296) profiles without losing @@ -16,8 +20,8 @@ shipped semver tag; older entries summarize the foundational work by theme. ## macOS Author v0.3.95-author.1 — 2026-07-27 -`mac-v0.3.95-author.1` is the current macOS Author tagged source. Its -matching GitHub release remains an unpublished draft. This entry does not +`mac-v0.3.95-author.1` is the prior macOS Author tagged source. Its +matching GitHub release was an unpublished draft. This entry does not indicate publication or assert asset availability. The macOS flavor remains author-only and does not include device operations. diff --git a/docs/src/introduction.md b/docs/src/introduction.md index c7e0276..e8bed7c 100644 --- a/docs/src/introduction.md +++ b/docs/src/introduction.md @@ -22,10 +22,10 @@ application** with two editions: and elevation methods under `system`) are intentionally omitted. Authors deploy later from the Full edition on Windows or Linux. -The current Windows/Linux Full-edition tagged source is `v0.3.95`. The -current macOS Author tagged source is `mac-v0.3.95-author.1`. Both matching +The current Windows/Linux Full-edition tagged source is `v0.3.96`. The +current macOS Author tagged source is `mac-v0.3.96-author.1`. Both matching GitHub releases remain unpublished drafts. The package version on `main` is -`0.3.95`; the macOS Author package version is `0.3.95-author.1`. +`0.3.96`; the macOS Author package version is `0.3.96-author.1`. If you've ever maintained a security baseline by editing GPO templates, exporting Defender for Endpoint settings to a spreadsheet, or copy-pasting between half a dozen runbooks - this app is for you. diff --git a/docs/src/operations/ci.md b/docs/src/operations/ci.md index aaed3f1..466cc6c 100644 --- a/docs/src/operations/ci.md +++ b/docs/src/operations/ci.md @@ -13,7 +13,7 @@ ConfigForge uses GitHub Actions from `.github/workflows/`. The product is an Ele The Win/Linux Release workflow intentionally ignores hyphen-suffix tags (`!v*-*`). macOS Author releases use separate tags such as -`mac-v0.3.95-author.1`; dispatch the protected `main` workflow definition +`mac-v0.3.96-author.1`; dispatch the protected `main` workflow definition manually and let its checkout step select the immutable macOS tag. ## What `pr-check.yml` runs @@ -37,7 +37,7 @@ scenarios. The prior `mac-v0.3.94-author.1` draft release remains unpublished; workflow run [#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418) verified its five assets. The current macOS Author tagged source is -`mac-v0.3.95-author.1`; its matching GitHub release remains an unpublished +`mac-v0.3.96-author.1`; its matching GitHub release remains an unpublished draft. Use current GitHub checks and release metadata as the authority for build and asset status. @@ -73,7 +73,7 @@ the immutable macOS tag: gh workflow run "Release (macOS author)" \ --repo Azure/ConfigForge \ --ref main \ - -f release_tag=mac-v0.3.95-author.1 + -f release_tag=mac-v0.3.96-author.1 ``` The target draft release and tag must already exist. The workflow loads its @@ -81,10 +81,10 @@ definition from `main`, checks out `release_tag`, verifies that `HEAD` resolves to the tag, checks that tagged tree with the dependency-free public-asset guard from protected `main`, then builds with `electron-builder.author.yml`. -For `mac-v0.3.95-author.1`, it uses exactly these expected asset names: +For `mac-v0.3.96-author.1`, it uses exactly these expected asset names: -1. `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg` -2. `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg.blockmap` +1. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg` +2. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap` 3. `latest-mac.yml` 4. `sbom-macos-author.cdx.json` 5. `SHA256SUMS-macos-author.txt` @@ -94,7 +94,7 @@ For the prior `mac-v0.3.94-author.1` release, workflow run [#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418) passed every gate and verified these five assets. The matching GitHub release exists but remains a draft and is unpublished. The current -`mac-v0.3.95-author.1` tagged source has a matching GitHub release that +`mac-v0.3.96-author.1` tagged source has a matching GitHub release that remains an unpublished draft; this documentation does not assert asset availability or publication. diff --git a/docs/src/quick-start/install-run.md b/docs/src/quick-start/install-run.md index 91f86ec..1331426 100644 --- a/docs/src/quick-start/install-run.md +++ b/docs/src/quick-start/install-run.md @@ -8,10 +8,10 @@ Benchmark Mapping, history, rationale, and Audit Pack export while omitting device operations. The native `oscfg` CLI is **not bundled** and is **not required** for authoring in either edition. -The current Windows/Linux Full-edition tagged source is `v0.3.95`. The -current macOS Author tagged source is `mac-v0.3.95-author.1`. Both matching +The current Windows/Linux Full-edition tagged source is `v0.3.96`. The +current macOS Author tagged source is `mac-v0.3.96-author.1`. Both matching GitHub releases remain unpublished drafts. The package version on `main` is -`0.3.95`; the macOS Author package version is `0.3.95-author.1`. +`0.3.96`; the macOS Author package version is `0.3.96-author.1`. ## Prerequisites @@ -30,7 +30,7 @@ cd ConfigForge > **Note:** `main` is the active Windows/Linux Full-edition line. On an Apple > Silicon Mac (M1 or later), build the current -> `mac-v0.3.95-author.1` tagged source. Its matching release remains an +> `mac-v0.3.96-author.1` tagged source. Its matching release remains an > unpublished draft. Intel Macs and universal binaries are not supported. > macOS release builds are unsigned by design. Clear quarantine after > copying the app into Applications: diff --git a/package-lock.json b/package-lock.json index d9b430b..95785bd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "configforge", - "version": "0.3.95-author.1", + "version": "0.3.96-author.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "configforge", - "version": "0.3.95-author.1", + "version": "0.3.96-author.1", "license": "MIT", "workspaces": [ "apps/*", @@ -33,7 +33,7 @@ }, "apps/desktop": { "name": "@configforge/desktop", - "version": "0.3.95-author.1", + "version": "0.3.96-author.1", "license": "MIT", "dependencies": { "@fluentui/react-components": "^9.73.8", diff --git a/package.json b/package.json index f95194f..dda9288 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "configforge", - "version": "0.3.95-author.1", + "version": "0.3.96-author.1", "private": true, "license": "MIT", "description": "ConfigForge \u2014 Cross-platform Electron desktop app for OSConfig security baseline authoring", diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs index 6a03d0e..3e29388 100644 --- a/scripts/release-metadata.test.mjs +++ b/scripts/release-metadata.test.mjs @@ -177,8 +177,8 @@ describe('public release metadata', () => { expect(contributing).toContain('creates immutable release tags and draft'); expect(support).toContain('The current repository maintainer is'); expect(readme).toContain('for ownership, active-branch, review, release, and cherry-pick guidance'); - expect(security).toContain('v0.3.95'); - expect(security).toContain('mac-v0.3.95-author.1'); + expect(security).toContain('v0.3.96'); + expect(security).toContain('mac-v0.3.96-author.1'); expect(security).toContain('Microsoft Security Response Center'); expect(security).toContain('Microsoft OSConfig project'); expect(support).toContain('best-effort basis'); diff --git a/scripts/ship-mac.ps1 b/scripts/ship-mac.ps1 index 0cd192a..edc1985 100644 --- a/scripts/ship-mac.ps1 +++ b/scripts/ship-mac.ps1 @@ -21,7 +21,7 @@ because we forgot step 1 on an earlier author release and had to retry). .PARAMETER Tag - The release tag, e.g. "mac-v0.3.95-author.1". Must already exist as a + The release tag, e.g. "mac-v0.3.96-author.1". Must already exist as a git tag on the mac-author-build branch and be pushed to origin. .PARAMETER ReleaseTitle @@ -35,10 +35,10 @@ Optional path to a release-notes file. Cannot be combined with -Notes. .EXAMPLE - .\scripts\ship-mac.ps1 -Tag mac-v0.3.95-author.1 + .\scripts\ship-mac.ps1 -Tag mac-v0.3.96-author.1 .EXAMPLE - .\scripts\ship-mac.ps1 -Tag mac-v0.3.95-author.1 -NotesFile .\apps\desktop\build\release-notes-author.md + .\scripts\ship-mac.ps1 -Tag mac-v0.3.96-author.1 -NotesFile .\apps\desktop\build\release-notes-author.md #> [CmdletBinding()]