From d68e2d054de01ce3a263acc64a67c69f99f6a4a4 Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Tue, 28 Jul 2026 16:07:25 +0200 Subject: [PATCH 1/6] docs(changelog): prepare v2.10.3 release notes Signed-off-by: PythonWoods --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 555eb54..e221115 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,9 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [Unreleased] +### Fixed +- **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.3`. + ## [2.10.2] - 2026-07-28 ### Fixed From 0e0fdebacbc326fdda4d9967bb6000e43bb6bf6f Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Tue, 28 Jul 2026 16:27:54 +0200 Subject: [PATCH 2/6] ci(security): configure CodeQL analysis Signed-off-by: PythonWoods --- .github/workflows/codeql.yml | 50 ++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..252ce86 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,50 @@ +# SPDX-FileCopyrightText: 2026 PythonWoods +# SPDX-License-Identifier: Apache-2.0 + +name: Zenzic Action CodeQL + +on: + push: + branches: [ main ] + paths: + - 'scripts/**' + - 'action.yml' + - '.github/workflows/codeql.yml' + pull_request: + branches: [ main ] + paths: + - 'scripts/**' + - 'action.yml' + - '.github/workflows/codeql.yml' + schedule: + - cron: '24 3 * * 1' + +permissions: + actions: read + contents: read + security-events: write + +jobs: + analyze: + if: vars.ENABLE_CODEQL == 'true' + name: Analyze + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + language: [ python ] # Assumendo che gli script interni (es. pin_core.py) siano in Python + + steps: + - name: Checkout Repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 \ No newline at end of file From cbc3694b6ebf10405e46cb4bd0227e2b0d7eca86 Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Tue, 28 Jul 2026 18:42:37 +0200 Subject: [PATCH 3/6] feat(tooling): orchestrate release and core pin workflows Signed-off-by: PythonWoods --- CONTRIBUTING.md | 17 +++++------ RELEASE.md | 19 +++++++------ justfile | 75 ++++++++++++++++++++++++++++++++++++++++--------- 3 files changed, 79 insertions(+), 32 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 535faba..743e5c8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -110,18 +110,15 @@ uvx pre-commit autoupdate --freeze # 1. Ensure branch is clean and checks are green just verify -# 2. Update the Zenzic core pin to the target version (e.g., 0.25.0) -just pin-core 0.26.2 +# 2. Preview orchestrated release (version bump + core pin) +just release-dry patch 0.26.3 -# 3. Check alignment between core and action dependencies -just versions +# 3. Apply orchestrated release in one signed commit +just release patch 0.26.3 -# 4. Preview version changes (dry-run) -just release-dry patch +# 4. Validate release metadata/core-pin parity +just audit-release -# 5. Apply the version bump, commit, and create tag -just release patch - -# 6. Push commit and tag +# 5. Push commit and tag git push && git push --tags ``` diff --git a/RELEASE.md b/RELEASE.md index 033e854..73ea47a 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -27,23 +27,26 @@ Before tagging, every item must be green: # 1. Create release branch git checkout -b release/vX.Y.Z -# 2. Realign core pin (if updating Zenzic Core dependency) -just pin-core +# 2. Preview orchestrated release (version bump + core pin) +just release-dry -# 3. Bump version and update changelog -just release +# 3. Execute orchestrated release in one signed commit +just release -# 4. Open and merge PR into main +# 4. Validate release metadata/core-pin parity +just audit-release -# 5. Switch to main and pull latest +# 5. Open and merge PR into main + +# 6. Switch to main and pull latest git checkout main git pull origin main -# 6. Create the release tag and push +# 7. Create the release tag and push git tag -s -m "Release v2.10.2" v2.10.2 git push origin v2.10.2 -# 7. Move the floating v2 tag to the new release: +# 8. Move the floating v2 tag to the new release: git tag -s -fa v2 v2.10.2^{} -m "release: v2.10.2" git push origin v2 --force diff --git a/justfile b/justfile index c02de8f..90e2b99 100644 --- a/justfile +++ b/justfile @@ -5,22 +5,28 @@ set shell := ["bash", "-c"] # just — developer workflow for zenzic-action. # Use `just --list` to see available commands. +# Key release flow: +# just release +# just release-dry +# just audit-release # Release orchestration: explicit, transparent, and lockfile-first. -release part: _release-contracts +release part core_version: _release-contracts #!/usr/bin/env bash set -euo pipefail case "{{ part }}" in patch|minor|major) ;; *) echo "Invalid part '{{ part }}'. Use patch|minor|major"; exit 2 ;; esac - uvx --from "bump-my-version==1.2.6" bump-my-version bump {{ part }} + just _validate-semver "{{core_version}}" + uvx --from "bump-my-version==1.2.6" bump-my-version bump {{ part }} --no-commit + just _pin-core-apply "{{core_version}}" if [ -f package-lock.json ]; then npm ci fi version="$(uvx --from "bump-my-version==1.2.6" bump-my-version show current_version)" git add -u - git commit -S -s -m "release: bump version to ${version}" + git commit -S -s -m "release: bump version to ${version} (core {{core_version}})" # Show the current action version version: @@ -47,20 +53,43 @@ versions: fi echo "✅ Ecosystem alignment verified." -# Realign the Zenzic Core pin in action.yml using the anchored marker -# Usage: just pin-core -pin-core version: +audit-release: + #!/usr/bin/env bash + set -euo pipefail + ACT_BUMP="$(uvx --from 'bump-my-version==1.2.6' bump-my-version show current_version)" + ACT_PKG="$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -n1)" + ACT_REL="$(grep -oP '\| Version \| v\K[0-9.]+' RELEASE.md)" + CORE_YML="$(just core-version)" + CORE_PY="$(grep -oP 'zenzic==\K[0-9.]+' pyproject.toml)" + CORE_README="$(grep -oP '\| `version` \| `\K[0-9.]+' README.md)" + if [[ -z "$ACT_BUMP" || -z "$ACT_PKG" || -z "$ACT_REL" || -z "$CORE_YML" || -z "$CORE_PY" || -z "$CORE_README" ]]; then + echo "audit-release failed: missing expected release/core markers" + exit 1 + fi + if [[ "$ACT_BUMP" != "$ACT_PKG" || "$ACT_BUMP" != "$ACT_REL" ]]; then + echo "audit-release failed: action version mismatch (bump/package/release)" + echo " bump=$ACT_BUMP package.json=$ACT_PKG RELEASE.md=$ACT_REL" + exit 1 + fi + if [[ "$CORE_YML" != "$CORE_PY" || "$CORE_YML" != "$CORE_README" ]]; then + echo "audit-release failed: core pin mismatch (action.yml/pyproject/README)" + echo " action.yml=$CORE_YML pyproject=$CORE_PY README.md=$CORE_README" + exit 1 + fi + grep -q "core version (\`$CORE_YML\`)" RELEASE.md + echo "✅ audit-release: release metadata and core pin alignment are coherent." + +_validate-semver version: #!/usr/bin/env bash set -euo pipefail if [[ ! "{{version}}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "Invalid version '{{version}}'. Use MAJOR.MINOR.PATCH" exit 2 fi - if [ -n "$(git status --porcelain)" ]; then - echo "Working tree is not clean. Commit or stash changes before pin-core." - exit 3 - fi - echo "Aligning Zenzic Core pin to {{version}}..." + +_pin-core-apply version: + #!/usr/bin/env bash + set -euo pipefail uv run python scripts/pin_core.py {{version}} sed -i 's/"zenzic\(>=\|==\).*"/"zenzic=={{version}}"/g' pyproject.toml sed -i 's/core version (`.*`)/core version (`{{version}}`)/g' RELEASE.md @@ -68,6 +97,19 @@ pin-core version: sed -i 's/version (`.*`)/version (`{{version}}`)/' RELEASE.md sed -i 's/just pin-core [0-9.]\+/just pin-core {{version}}/g' CONTRIBUTING.md sed -i 's/default: ".*" # x-zenzic-core-pin.*/default: "{{version}}" # x-zenzic-core-pin/' action.yml + +# Realign the Zenzic Core pin in action.yml using the anchored marker +# Usage: just pin-core +pin-core version: + #!/usr/bin/env bash + set -euo pipefail + just _validate-semver "{{version}}" + if [ -n "$(git status --porcelain)" ]; then + echo "Working tree is not clean. Commit or stash changes before pin-core." + exit 3 + fi + echo "Aligning Zenzic Core pin to {{version}}..." + just _pin-core-apply "{{version}}" git add action.yml README.md .bumpversion.toml pyproject.toml RELEASE.md CONTRIBUTING.md git commit -S -s -m "chore(deps): pin zenzic core to {{version}}" @@ -76,13 +118,15 @@ pin-core version: pin-core-dry version: #!/usr/bin/env bash set -euo pipefail + just _validate-semver "{{version}}" uv run python scripts/pin_core.py {{version}} --dry-run -# Simulate a release bump without modifying any files -# Usage: just release-dry patch|minor|major [--short] -release-dry part *args: +# Simulate a release bump and core-pin orchestration without modifying files +# Usage: just release-dry patch|minor|major [--short] +release-dry part core_version *args: #!/usr/bin/env bash set -euo pipefail + just _validate-semver "{{core_version}}" _short=false for _arg in {{args}}; do [[ "$_arg" == "--short" ]] && _short=true; done if $_short; then @@ -91,6 +135,8 @@ release-dry part *args: else uvx --from "bump-my-version==1.2.6" bump-my-version bump {{part}} --dry-run --allow-dirty --verbose fi + echo "" + just pin-core-dry "{{core_version}}" # Check REUSE/SPDX licence compliance reuse: @@ -254,6 +300,7 @@ _release-contracts: grep -qE '^pin-core version:' justfile grep -qE '^release part:' justfile grep -qE '^release-dry part' justfile + grep -qE '^audit-release:' justfile grep -qE '^check-core-pin-local:' justfile grep -q -- '--dry-run --allow-dirty --verbose' justfile grep -q 'ZENZIC_CORE_PATH' justfile From c4c0b5afdb561f74cc4d0abeb1f5fd5bc3b86d26 Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Tue, 28 Jul 2026 18:51:42 +0200 Subject: [PATCH 4/6] fix(workflow): ensure newline at end of file in CodeQL analysis step Signed-off-by: PythonWoods --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 252ce86..186da47 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -47,4 +47,4 @@ jobs: uses: github/codeql-action/autobuild@v3 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 \ No newline at end of file + uses: github/codeql-action/analyze@v3 From 848b1e402c63bc81dd86bfdac7a845a3a6f73545 Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Tue, 28 Jul 2026 19:13:04 +0200 Subject: [PATCH 5/6] fix(justfile): correct grep pattern for release part in _release-contracts Signed-off-by: PythonWoods --- justfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/justfile b/justfile index 90e2b99..d8e585b 100644 --- a/justfile +++ b/justfile @@ -298,7 +298,7 @@ _release-contracts: grep -qE '^version:' justfile grep -qE '^core-version:' justfile grep -qE '^pin-core version:' justfile - grep -qE '^release part:' justfile + grep -qE '^release part core_version:' justfile grep -qE '^release-dry part' justfile grep -qE '^audit-release:' justfile grep -qE '^check-core-pin-local:' justfile From 2519f1f6dac45f743a1db2185801dcadc2a2d167 Mon Sep 17 00:00:00 2001 From: PythonWoods Date: Tue, 28 Jul 2026 19:13:18 +0200 Subject: [PATCH 6/6] release: bump version to 2.10.3 (core 0.26.3) Signed-off-by: PythonWoods --- .bumpversion.toml | 4 ++-- CHANGELOG.md | 2 ++ README.md | 4 ++-- RELEASE.md | 16 ++++++++-------- SECURITY.md | 4 ++-- action.yml | 2 +- package.json | 2 +- pyproject.toml | 2 +- 8 files changed, 19 insertions(+), 17 deletions(-) diff --git a/.bumpversion.toml b/.bumpversion.toml index b9ebc2f..d8af4dc 100644 --- a/.bumpversion.toml +++ b/.bumpversion.toml @@ -2,7 +2,7 @@ # SPDX-License-Identifier: Apache-2.0 [tool.bumpversion] -current_version = "2.10.2" +current_version = "2.10.3" parse = "(?P\\d+)\\.(?P\\d+)\\.(?P\\d+)" serialize = ["{major}.{minor}.{patch}"] @@ -47,4 +47,4 @@ replace = '''| `{new_version}` (current) | ✅ All security fixes | # bump-my-version does NOT manage these files; they are listed here for discoverability. # --------------------------------------------------------------------------- [tool.bumpversion.custom_variables.core_version] -current = "0.26.2" +current = "0.26.3" diff --git a/CHANGELOG.md b/CHANGELOG.md index e221115..2a19800 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ All notable changes to zenzic-action are documented in this file. The project ad ## [Unreleased] +## [2.10.3] - 2026-07-28 + ### Fixed - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.3`. diff --git a/README.md b/README.md index 6e278f2..49465ea 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,7 @@ The minimal configuration — zero Python setup, SARIF to Code Scanning in one s - name: Run Zenzic Documentation Quality Gate uses: PythonWoods/zenzic-action@v2 with: - version: "0.26.2" + version: "0.26.3" format: sarif upload-sarif: "true" permissions: @@ -207,7 +207,7 @@ jobs: | Input | Default | Description | |:---|:---|:---| -| `version` | `0.26.2` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. | +| `version` | `0.26.3` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. | | `format` | `"text"` | Output format: `text`, `json`, or `sarif` | | `upload-sarif` | `"false"` | Automatically upload SARIF output to GitHub Code Scanning | diff --git a/RELEASE.md b/RELEASE.md index 73ea47a..50adc00 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -6,7 +6,7 @@ | Field | Value | | :------ | :--------- | -| Version | v2.10.2 | +| Version | v2.10.3 | | Date | 2026-07-28 | | Status | Stable | @@ -14,9 +14,9 @@ Before tagging, every item must be green: -- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.26.2`) -- [ ] `package.json` version bumped to `2.10.2` -- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.26.2`) +- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.26.3`) +- [ ] `package.json` version bumped to `2.10.3` +- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.26.3`) - [ ] `just versions` — returns `✅ Ecosystem alignment verified.` - [ ] `just verify` — exits 0 - [ ] `zenzic check .` — zero findings (DQS 100/100) @@ -43,15 +43,15 @@ git checkout main git pull origin main # 7. Create the release tag and push -git tag -s -m "Release v2.10.2" v2.10.2 -git push origin v2.10.2 +git tag -s -m "Release v2.10.3" v2.10.3 +git push origin v2.10.3 # 8. Move the floating v2 tag to the new release: -git tag -s -fa v2 v2.10.2^{} -m "release: v2.10.2" +git tag -s -fa v2 v2.10.3^{} -m "release: v2.10.3" git push origin v2 --force # Verification (Atomic Parity Check): -git rev-parse v2^{} v2.10.2^{} +git rev-parse v2^{} v2.10.3^{} # SUCCESS: Both hashes must be identical. ``` diff --git a/SECURITY.md b/SECURITY.md index 74a7e25..73db4a9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -75,8 +75,8 @@ by the wrapper script — it is consumed exclusively by `github/codeql-action/up | Version | Support status | |---------|----------------| -| `2.10.2` (current) | ✅ All security fixes | -| `< 2.10.2` | ❌ End of life — no support | +| `2.10.3` (current) | ✅ All security fixes | +| `< 2.10.3` | ❌ End of life — no support | --- diff --git a/action.yml b/action.yml index 31abe1a..7a1b898 100644 --- a/action.yml +++ b/action.yml @@ -16,7 +16,7 @@ inputs: version: description: "Zenzic version to use. Defaults to latest stable." required: false - default: "0.26.2" # x-zenzic-core-pin + default: "0.26.3" # x-zenzic-core-pin format: description: "Output format: 'text', 'json', or 'sarif'." required: false diff --git a/package.json b/package.json index 0cf9037..f437efe 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "zenzic-action", - "version": "2.10.2", + "version": "2.10.3", "private": true, "description": "Official GitHub Action for Zenzic — Documentation Quality Gate", "license": "Apache-2.0", diff --git a/pyproject.toml b/pyproject.toml index 4d9e674..a6bf01f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,7 @@ license = {text = "Apache-2.0"} authors = [{name = "PythonWoods", email = "dev@pythonwoods.dev"}] dynamic = ["version"] dependencies = [ - "zenzic==0.26.2", + "zenzic==0.26.3", ] [project.urls]