chore(release): v2.10.2 Core Baseline Alignment

.bumpversion.toml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [tool.bumpversion]
-current_version = "2.10.1"
+current_version = "2.10.2"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 
@@ -47,4 +47,4 @@ replace = '''| `{new_version}` (current) | ✅ All security fixes |
 # bump-my-version does NOT manage these files; they are listed here for discoverability.
 # ---------------------------------------------------------------------------
 [tool.bumpversion.custom_variables.core_version]
-current = "0.25.3"
+current = "0.26.2"

.github/workflows/compliance.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/release.yml

@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Generate GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           generate_release_notes: true
           make_latest: true

.github/workflows/security-posture.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check for SECURITY.md
         run: |

.github/workflows/self-check.yml

@@ -37,7 +37,7 @@ jobs:
     # Local and CI run identical 'just check' invocations.
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Determine Zenzic Core Branch (Parity or Fallback)
         id: resolve-branch
@@ -106,7 +106,7 @@ jobs:
           fi
 
       - name: Checkout local zenzic (unreleased)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: PythonWoods/zenzic
           ref: ${{ steps.resolve-branch.outputs.core_ref }}

.zenzic.toml

@@ -118,7 +118,7 @@ brand_obsolescence = [
 # IMPACT:   In --audit mode, shown with [POLICY_EXEMPTION] label.
 #
 [governance.directory_policies]
-"README.md" = ["Z104"]
+"README.md" = ["Z101"]
 "assets/**" = ["Z405"]
 
 # Governance Playbook:

CHANGELOG.md

@@ -9,6 +9,11 @@ All notable changes to zenzic-action are documented in this file. The project ad
 
 ## [Unreleased]
 
+## [2.10.2] - 2026-07-28
+
+### Fixed
+- **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.2`, integrating critical URP unification and static asset resolution fixes.
+
 ## [2.10.1] - 2026-07-26
 
 ### Changed

CONTRIBUTING.md

@@ -111,7 +111,7 @@ uvx pre-commit autoupdate --freeze
 just verify
 
 # 2. Update the Zenzic core pin to the target version (e.g., 0.25.0)
-just pin-core 0.25.3
+just pin-core 0.26.2
 
 # 3. Check alignment between core and action dependencies
 just versions

README.md

@@ -59,7 +59,7 @@ The minimal configuration — zero Python setup, SARIF to Code Scanning in one s
 - name: Run Zenzic Documentation Quality Gate
   uses: PythonWoods/zenzic-action@v2
   with:
-    version: "0.25.3"
+    version: "0.26.2"
     format: sarif
     upload-sarif: "true"
   permissions:
@@ -207,7 +207,7 @@ jobs:
 
 | Input | Default | Description |
 |:---|:---|:---|
-| `version` | `0.25.3` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. |
+| `version` | `0.26.2` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. |
 
 | `format` | `"text"` | Output format: `text`, `json`, or `sarif` |
 | `upload-sarif` | `"false"` | Automatically upload SARIF output to GitHub Code Scanning |

RELEASE.md

@@ -6,17 +6,17 @@
 
 | Field   | Value      |
 | :------ | :--------- |
-| Version | v2.10.1 |
-| Date    | 2026-07-26 |
+| Version | v2.10.2 |
+| Date    | 2026-07-28 |
 | Status  | Stable     |
 
 ## Release Checklist
 
 Before tagging, every item must be green:
 
-- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.25.3`)
-- [ ] `package.json` version bumped to `2.10.1`
-- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.25.3`)
+- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.26.2`)
+- [ ] `package.json` version bumped to `2.10.2`
+- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.26.2`)
 - [ ] `just versions` — returns `✅ Ecosystem alignment verified.`
 - [ ] `just verify` — exits 0
 - [ ] `zenzic check .` — zero findings (DQS 100/100)
@@ -40,15 +40,15 @@ git checkout main
 git pull origin main
 
 # 6. Create the release tag and push
-git tag -s -m "Release v2.10.1" v2.10.1
-git push origin v2.10.1
+git tag -s -m "Release v2.10.2" v2.10.2
+git push origin v2.10.2
 
 # 7. Move the floating v2 tag to the new release:
-git tag -s -fa v2 v2.10.1^{} -m "release: v2.10.1"
+git tag -s -fa v2 v2.10.2^{} -m "release: v2.10.2"
 git push origin v2 --force
 
 # Verification (Atomic Parity Check):
-git rev-parse v2^{} v2.10.1^{}
+git rev-parse v2^{} v2.10.2^{}
 # SUCCESS: Both hashes must be identical.
 ```
 

SECURITY.md

@@ -75,8 +75,8 @@ by the wrapper script — it is consumed exclusively by `github/codeql-action/up
 
 | Version | Support status |
 |---------|----------------|
-| `2.10.1` (current) | ✅ All security fixes |
-| `< 2.10.1` | ❌ End of life — no support |
+| `2.10.2` (current) | ✅ All security fixes |
+| `< 2.10.2` | ❌ End of life — no support |
 
 ---
 

action.yml

@@ -16,7 +16,7 @@ inputs:
   version:
     description: "Zenzic version to use. Defaults to latest stable."
     required: false
-    default: "0.25.3" # x-zenzic-core-pin
+    default: "0.26.2" # x-zenzic-core-pin
   format:
     description: "Output format: 'text', 'json', or 'sarif'."
     required: false

package.json

@@ -1,6 +1,6 @@
 {
   "name": "zenzic-action",
-  "version": "2.10.1",
+  "version": "2.10.2",
   "private": true,
   "description": "Official GitHub Action for Zenzic — Documentation Quality Gate",
   "license": "Apache-2.0",

pyproject.toml

@@ -10,7 +10,7 @@ license = {text = "Apache-2.0"}
 authors = [{name = "PythonWoods", email = "dev@pythonwoods.dev"}]
 dynamic = ["version"]
 dependencies = [
-    "zenzic==0.25.3",
+    "zenzic==0.26.2",
 ]
 
 [project.urls]