Harden PyPI and GitHub release trust#105

Draft

ChelseaKR wants to merge 1 commit into

mainfrom

agent/harden-release-trust

ChelseaKR commented Jul 24, 2026

Owner

Summary

Verifies signed tags from reviewed main, builds the exact commit, and rechecks tag identity before PyPI and GitHub publication.
pins the maintainer SSH signer in the repository
documents the release-boundary change in the changelog

Validation

portfolio conformance release_workflow: PASS
actionlint: PASS
zizmor offline, medium+ findings: none
YAML parse and git diff --check: PASS


          fix: harden release publication flow

0667b37

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet