chore(release): v2.10.3 Core Baseline Alignment

.bumpversion.toml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [tool.bumpversion]
-current_version = "2.10.2"
+current_version = "2.10.3"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 
@@ -47,4 +47,4 @@ replace = '''| `{new_version}` (current) | ✅ All security fixes |
 # bump-my-version does NOT manage these files; they are listed here for discoverability.
 # ---------------------------------------------------------------------------
 [tool.bumpversion.custom_variables.core_version]
-current = "0.26.2"
+current = "0.26.3"

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: 2026 PythonWoods <dev@pythonwoods.dev>
+# SPDX-License-Identifier: Apache-2.0
+
+name: Zenzic Action CodeQL
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'scripts/**'
+      - 'action.yml'
+      - '.github/workflows/codeql.yml'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'scripts/**'
+      - 'action.yml'
+      - '.github/workflows/codeql.yml'
+  schedule:
+    - cron: '24 3 * * 1'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    if: vars.ENABLE_CODEQL == 'true'
+    name: Analyze
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ python ] # Assumendo che gli script interni (es. pin_core.py) siano in Python
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

CHANGELOG.md

@@ -9,6 +9,11 @@ All notable changes to zenzic-action are documented in this file. The project ad
 
 ## [Unreleased]
 
+## [2.10.3] - 2026-07-28
+
+### Fixed
+- **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.3`.
+
 ## [2.10.2] - 2026-07-28
 
 ### Fixed

CONTRIBUTING.md

@@ -110,18 +110,15 @@ uvx pre-commit autoupdate --freeze
 # 1. Ensure branch is clean and checks are green
 just verify
 
-# 2. Update the Zenzic core pin to the target version (e.g., 0.25.0)
-just pin-core 0.26.2
+# 2. Preview orchestrated release (version bump + core pin)
+just release-dry patch 0.26.3
 
-# 3. Check alignment between core and action dependencies
-just versions
+# 3. Apply orchestrated release in one signed commit
+just release patch 0.26.3
 
-# 4. Preview version changes (dry-run)
-just release-dry patch
+# 4. Validate release metadata/core-pin parity
+just audit-release
 
-# 5. Apply the version bump, commit, and create tag
-just release patch
-
-# 6. Push commit and tag
+# 5. Push commit and tag
 git push && git push --tags
 ```

README.md

@@ -59,7 +59,7 @@ The minimal configuration — zero Python setup, SARIF to Code Scanning in one s
 - name: Run Zenzic Documentation Quality Gate
   uses: PythonWoods/zenzic-action@v2
   with:
-    version: "0.26.2"
+    version: "0.26.3"
     format: sarif
     upload-sarif: "true"
   permissions:
@@ -207,7 +207,7 @@ jobs:
 
 | Input | Default | Description |
 |:---|:---|:---|
-| `version` | `0.26.2` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. |
+| `version` | `0.26.3` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. |
 
 | `format` | `"text"` | Output format: `text`, `json`, or `sarif` |
 | `upload-sarif` | `"false"` | Automatically upload SARIF output to GitHub Code Scanning |

RELEASE.md

@@ -6,17 +6,17 @@
 
 | Field   | Value      |
 | :------ | :--------- |
-| Version | v2.10.2 |
+| Version | v2.10.3 |
 | Date    | 2026-07-28 |
 | Status  | Stable     |
 
 ## Release Checklist
 
 Before tagging, every item must be green:
 
-- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.26.2`)
-- [ ] `package.json` version bumped to `2.10.2`
-- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.26.2`)
+- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.26.3`)
+- [ ] `package.json` version bumped to `2.10.3`
+- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.26.3`)
 - [ ] `just versions` — returns `✅ Ecosystem alignment verified.`
 - [ ] `just verify` — exits 0
 - [ ] `zenzic check .` — zero findings (DQS 100/100)
@@ -27,28 +27,31 @@ Before tagging, every item must be green:
 # 1. Create release branch
 git checkout -b release/vX.Y.Z
 
-# 2. Realign core pin (if updating Zenzic Core dependency)
-just pin-core <version>
+# 2. Preview orchestrated release (version bump + core pin)
+just release-dry <patch|minor|major> <core-version>
 
-# 3. Bump version and update changelog
-just release <patch|minor|major>
+# 3. Execute orchestrated release in one signed commit
+just release <patch|minor|major> <core-version>
 
-# 4. Open and merge PR into main
+# 4. Validate release metadata/core-pin parity
+just audit-release
 
-# 5. Switch to main and pull latest
+# 5. Open and merge PR into main
+
+# 6. Switch to main and pull latest
 git checkout main
 git pull origin main
 
-# 6. Create the release tag and push
-git tag -s -m "Release v2.10.2" v2.10.2
-git push origin v2.10.2
+# 7. Create the release tag and push
+git tag -s -m "Release v2.10.3" v2.10.3
+git push origin v2.10.3
 
-# 7. Move the floating v2 tag to the new release:
-git tag -s -fa v2 v2.10.2^{} -m "release: v2.10.2"
+# 8. Move the floating v2 tag to the new release:
+git tag -s -fa v2 v2.10.3^{} -m "release: v2.10.3"
 git push origin v2 --force
 
 # Verification (Atomic Parity Check):
-git rev-parse v2^{} v2.10.2^{}
+git rev-parse v2^{} v2.10.3^{}
 # SUCCESS: Both hashes must be identical.
 ```
 

SECURITY.md

@@ -75,8 +75,8 @@ by the wrapper script — it is consumed exclusively by `github/codeql-action/up
 
 | Version | Support status |
 |---------|----------------|
-| `2.10.2` (current) | ✅ All security fixes |
-| `< 2.10.2` | ❌ End of life — no support |
+| `2.10.3` (current) | ✅ All security fixes |
+| `< 2.10.3` | ❌ End of life — no support |
 
 ---
 

action.yml

@@ -16,7 +16,7 @@ inputs:
   version:
     description: "Zenzic version to use. Defaults to latest stable."
     required: false
-    default: "0.26.2" # x-zenzic-core-pin
+    default: "0.26.3" # x-zenzic-core-pin
   format:
     description: "Output format: 'text', 'json', or 'sarif'."
     required: false

justfile

@@ -5,22 +5,28 @@ set shell := ["bash", "-c"]
 
 # just — developer workflow for zenzic-action.
 # Use `just --list` to see available commands.
+# Key release flow:
+#   just release <patch|minor|major> <core-version>
+#   just release-dry <patch|minor|major> <core-version>
+#   just audit-release
 
 # Release orchestration: explicit, transparent, and lockfile-first.
-release part: _release-contracts
+release part core_version: _release-contracts
     #!/usr/bin/env bash
     set -euo pipefail
     case "{{ part }}" in
         patch|minor|major) ;;
         *) echo "Invalid part '{{ part }}'. Use patch|minor|major"; exit 2 ;;
     esac
-    uvx --from "bump-my-version==1.2.6" bump-my-version bump {{ part }}
+    just _validate-semver "{{core_version}}"
+    uvx --from "bump-my-version==1.2.6" bump-my-version bump {{ part }} --no-commit
+    just _pin-core-apply "{{core_version}}"
     if [ -f package-lock.json ]; then
         npm ci
     fi
     version="$(uvx --from "bump-my-version==1.2.6" bump-my-version show current_version)"
     git add -u
-    git commit -S -s -m "release: bump version to ${version}"
+    git commit -S -s -m "release: bump version to ${version} (core {{core_version}})"
 
 # Show the current action version
 version:
@@ -47,27 +53,63 @@ versions:
     fi
     echo "✅ Ecosystem alignment verified."
 
-# Realign the Zenzic Core pin in action.yml using the anchored marker
-# Usage: just pin-core <version>
-pin-core version:
+audit-release:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    ACT_BUMP="$(uvx --from 'bump-my-version==1.2.6' bump-my-version show current_version)"
+    ACT_PKG="$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -n1)"
+    ACT_REL="$(grep -oP '\| Version \| v\K[0-9.]+' RELEASE.md)"
+    CORE_YML="$(just core-version)"
+    CORE_PY="$(grep -oP 'zenzic==\K[0-9.]+' pyproject.toml)"
+    CORE_README="$(grep -oP '\| `version` \| `\K[0-9.]+' README.md)"
+    if [[ -z "$ACT_BUMP" || -z "$ACT_PKG" || -z "$ACT_REL" || -z "$CORE_YML" || -z "$CORE_PY" || -z "$CORE_README" ]]; then
+        echo "audit-release failed: missing expected release/core markers"
+        exit 1
+    fi
+    if [[ "$ACT_BUMP" != "$ACT_PKG" || "$ACT_BUMP" != "$ACT_REL" ]]; then
+        echo "audit-release failed: action version mismatch (bump/package/release)"
+        echo "  bump=$ACT_BUMP package.json=$ACT_PKG RELEASE.md=$ACT_REL"
+        exit 1
+    fi
+    if [[ "$CORE_YML" != "$CORE_PY" || "$CORE_YML" != "$CORE_README" ]]; then
+        echo "audit-release failed: core pin mismatch (action.yml/pyproject/README)"
+        echo "  action.yml=$CORE_YML pyproject=$CORE_PY README.md=$CORE_README"
+        exit 1
+    fi
+    grep -q "core version (\`$CORE_YML\`)" RELEASE.md
+    echo "✅ audit-release: release metadata and core pin alignment are coherent."
+
+_validate-semver version:
     #!/usr/bin/env bash
     set -euo pipefail
     if [[ ! "{{version}}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
         echo "Invalid version '{{version}}'. Use MAJOR.MINOR.PATCH"
         exit 2
     fi
-    if [ -n "$(git status --porcelain)" ]; then
-        echo "Working tree is not clean. Commit or stash changes before pin-core."
-        exit 3
-    fi
-    echo "Aligning Zenzic Core pin to {{version}}..."
+
+_pin-core-apply version:
+    #!/usr/bin/env bash
+    set -euo pipefail
     uv run python scripts/pin_core.py {{version}}
     sed -i 's/"zenzic\(>=\|==\).*"/"zenzic=={{version}}"/g' pyproject.toml
     sed -i 's/core version (`.*`)/core version (`{{version}}`)/g' RELEASE.md
     sed -i 's/core pin (`zenzic.*`)/core pin (`zenzic=={{version}}`)/g' RELEASE.md
     sed -i 's/version (`.*`)/version (`{{version}}`)/' RELEASE.md
     sed -i 's/just pin-core [0-9.]\+/just pin-core {{version}}/g' CONTRIBUTING.md
     sed -i 's/default: ".*" # x-zenzic-core-pin.*/default: "{{version}}" # x-zenzic-core-pin/' action.yml
+
+# Realign the Zenzic Core pin in action.yml using the anchored marker
+# Usage: just pin-core <version>
+pin-core version:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    just _validate-semver "{{version}}"
+    if [ -n "$(git status --porcelain)" ]; then
+        echo "Working tree is not clean. Commit or stash changes before pin-core."
+        exit 3
+    fi
+    echo "Aligning Zenzic Core pin to {{version}}..."
+    just _pin-core-apply "{{version}}"
     git add action.yml README.md .bumpversion.toml pyproject.toml RELEASE.md CONTRIBUTING.md
     git commit -S -s -m "chore(deps): pin zenzic core to {{version}}"
 
@@ -76,13 +118,15 @@ pin-core version:
 pin-core-dry version:
     #!/usr/bin/env bash
     set -euo pipefail
+    just _validate-semver "{{version}}"
     uv run python scripts/pin_core.py {{version}} --dry-run
 
-# Simulate a release bump without modifying any files
-# Usage: just release-dry patch|minor|major [--short]
-release-dry part *args:
+# Simulate a release bump and core-pin orchestration without modifying files
+# Usage: just release-dry patch|minor|major <core-version> [--short]
+release-dry part core_version *args:
     #!/usr/bin/env bash
     set -euo pipefail
+    just _validate-semver "{{core_version}}"
     _short=false
     for _arg in {{args}}; do [[ "$_arg" == "--short" ]] && _short=true; done
     if $_short; then
@@ -91,6 +135,8 @@ release-dry part *args:
     else
         uvx --from "bump-my-version==1.2.6" bump-my-version bump {{part}} --dry-run --allow-dirty --verbose
     fi
+    echo ""
+    just pin-core-dry "{{core_version}}"
 
 # Check REUSE/SPDX licence compliance
 reuse:
@@ -252,8 +298,9 @@ _release-contracts:
     grep -qE '^version:' justfile
     grep -qE '^core-version:' justfile
     grep -qE '^pin-core version:' justfile
-    grep -qE '^release part:' justfile
+    grep -qE '^release part core_version:' justfile
     grep -qE '^release-dry part' justfile
+    grep -qE '^audit-release:' justfile
     grep -qE '^check-core-pin-local:' justfile
     grep -q -- '--dry-run --allow-dirty --verbose' justfile
     grep -q 'ZENZIC_CORE_PATH' justfile

package.json

@@ -1,6 +1,6 @@
 {
   "name": "zenzic-action",
-  "version": "2.10.2",
+  "version": "2.10.3",
   "private": true,
   "description": "Official GitHub Action for Zenzic — Documentation Quality Gate",
   "license": "Apache-2.0",

pyproject.toml

@@ -10,7 +10,7 @@ license = {text = "Apache-2.0"}
 authors = [{name = "PythonWoods", email = "dev@pythonwoods.dev"}]
 dynamic = ["version"]
 dependencies = [
-    "zenzic==0.26.2",
+    "zenzic==0.26.3",
 ]
 
 [project.urls]