Skip to content
oss-kit
Install

Release and publishing

Release and publishing holds 7 of the standard’s 61 rules. Each one names the evidence that settles it and the skill that fixes it.

  1. R-PUB-01Publishing happens in CI, tied to a release tag, never from a developer machineoss-publishGitHub and GitLab
  2. R-PUB-02The publish job authenticates to the registry with trusted publishing, not a stored tokenoss-publishGitHub and GitLab
  3. R-PUB-03Published artifacts carry build provenanceoss-publishGitHub and GitLab
  4. R-PUB-04A human approves the run before anything reaches a public registryoss-publishGitHub and GitLab
  5. R-PUB-05A built artifact ships with an inventory of what went into itoss-publishGitHub and GitLab
  6. R-PUB-06Release assets are signed, or listed by hash in a signed manifestoss-publishGitHub and GitLab
  7. R-PUB-07A tag-published registry entry updates through the forge, not through a token a CI job holdsoss-publishGitHub and GitLab