From fbce96786f3162f1a659c7ec020e18dd7e0ea803 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 10:07:05 +0000 Subject: [PATCH 1/3] Add SicarioSpec Security & Governance Bundle to community catalog - Adds sicario-spec v0.5.1 entry to bundles/catalog.community.json - Adds row to docs/community/bundles.md - Bundle provides 1 extension (sicario-guard) and 11 presets - Required companion preset and extension catalogs are documented in README - Validated: bundle ID, version, repository, release artifact, catalog entry shape, checklists Closes #3619 Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- bundles/catalog.community.json | 33 +++++++++++++++++++++++++++++++-- docs/community/bundles.md | 1 + 2 files changed, 32 insertions(+), 2 deletions(-) diff --git a/bundles/catalog.community.json b/bundles/catalog.community.json index 7fbcfbd7ac..0a371c1814 100644 --- a/bundles/catalog.community.json +++ b/bundles/catalog.community.json @@ -1,6 +1,35 @@ { "schema_version": "1.0", - "updated_at": "2026-07-15T00:00:00Z", + "updated_at": "2026-07-22T00:00:00Z", "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/bundles/catalog.community.json", - "bundles": {} + "bundles": { + "sicario-spec": { + "name": "SicarioSpec Security & Governance Bundle", + "id": "sicario-spec", + "version": "0.5.1", + "role": "security-engineer", + "description": "Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates.", + "author": "SicarioSpec Contributors", + "license": "MIT", + "download_url": "https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/sicario-spec-0.5.1.zip", + "repository": "https://github.com/dfirs1car1o/sicario-spec", + "requires": { + "speckit_version": ">=0.9.0" + }, + "provides": { + "extensions": 1, + "presets": 11, + "steps": 0, + "workflows": 0 + }, + "tags": [ + "security", + "governance", + "compliance", + "appsec", + "threat-modeling" + ], + "verified": false + } + } } diff --git a/docs/community/bundles.md b/docs/community/bundles.md index 5eea42ff8f..4ed15e0d36 100644 --- a/docs/community/bundles.md +++ b/docs/community/bundles.md @@ -9,6 +9,7 @@ Accepted community bundle entries are published in [`bundles/catalog.community.j | Bundle | Purpose | Role or team | Provides | Required catalogs | URL | |--------|---------|--------------|----------|-------------------|-----| +| SicarioSpec Security & Governance Bundle | Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates. | `security-engineer` | 1 extension, 11 presets | Documented | [sicario-spec](https://github.com/dfirs1car1o/sicario-spec) | ## What to Submit From 94ee59639f242537a8880045a76eadde5211c2a9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 10:44:12 +0000 Subject: [PATCH 2/3] fix: revert sicario-spec bundle entry pending upstream README correction The upstream README uses mutable raw.githubusercontent.com/main catalog URLs instead of the v0.5.1 release-pinned URLs submitted in issue #3619, failing the required-catalog consistency check. Removing the catalog entry and docs row until the README is updated to match the submitted pinned URLs. Assisted-by: GitHub Copilot (model: claude-sonnet-4-5, autonomous) --- bundles/catalog.community.json | 33 ++------------------------------- docs/community/bundles.md | 1 - 2 files changed, 2 insertions(+), 32 deletions(-) diff --git a/bundles/catalog.community.json b/bundles/catalog.community.json index 0a371c1814..7fbcfbd7ac 100644 --- a/bundles/catalog.community.json +++ b/bundles/catalog.community.json @@ -1,35 +1,6 @@ { "schema_version": "1.0", - "updated_at": "2026-07-22T00:00:00Z", + "updated_at": "2026-07-15T00:00:00Z", "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/bundles/catalog.community.json", - "bundles": { - "sicario-spec": { - "name": "SicarioSpec Security & Governance Bundle", - "id": "sicario-spec", - "version": "0.5.1", - "role": "security-engineer", - "description": "Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates.", - "author": "SicarioSpec Contributors", - "license": "MIT", - "download_url": "https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/sicario-spec-0.5.1.zip", - "repository": "https://github.com/dfirs1car1o/sicario-spec", - "requires": { - "speckit_version": ">=0.9.0" - }, - "provides": { - "extensions": 1, - "presets": 11, - "steps": 0, - "workflows": 0 - }, - "tags": [ - "security", - "governance", - "compliance", - "appsec", - "threat-modeling" - ], - "verified": false - } - } + "bundles": {} } diff --git a/docs/community/bundles.md b/docs/community/bundles.md index 4ed15e0d36..5eea42ff8f 100644 --- a/docs/community/bundles.md +++ b/docs/community/bundles.md @@ -9,7 +9,6 @@ Accepted community bundle entries are published in [`bundles/catalog.community.j | Bundle | Purpose | Role or team | Provides | Required catalogs | URL | |--------|---------|--------------|----------|-------------------|-----| -| SicarioSpec Security & Governance Bundle | Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates. | `security-engineer` | 1 extension, 11 presets | Documented | [sicario-spec](https://github.com/dfirs1car1o/sicario-spec) | ## What to Submit From dc30ae09cd8d3b57070f57c6a7acd9aff688d438 Mon Sep 17 00:00:00 2001 From: Manfred Riem <15701806+mnriem@users.noreply.github.com> Date: Wed, 22 Jul 2026 05:57:08 -0500 Subject: [PATCH 3/3] Revert "fix: revert sicario-spec bundle entry pending upstream README correction" This reverts commit 94ee59639f242537a8880045a76eadde5211c2a9. --- bundles/catalog.community.json | 33 +++++++++++++++++++++++++++++++-- docs/community/bundles.md | 1 + 2 files changed, 32 insertions(+), 2 deletions(-) diff --git a/bundles/catalog.community.json b/bundles/catalog.community.json index 7fbcfbd7ac..0a371c1814 100644 --- a/bundles/catalog.community.json +++ b/bundles/catalog.community.json @@ -1,6 +1,35 @@ { "schema_version": "1.0", - "updated_at": "2026-07-15T00:00:00Z", + "updated_at": "2026-07-22T00:00:00Z", "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/bundles/catalog.community.json", - "bundles": {} + "bundles": { + "sicario-spec": { + "name": "SicarioSpec Security & Governance Bundle", + "id": "sicario-spec", + "version": "0.5.1", + "role": "security-engineer", + "description": "Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates.", + "author": "SicarioSpec Contributors", + "license": "MIT", + "download_url": "https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/sicario-spec-0.5.1.zip", + "repository": "https://github.com/dfirs1car1o/sicario-spec", + "requires": { + "speckit_version": ">=0.9.0" + }, + "provides": { + "extensions": 1, + "presets": 11, + "steps": 0, + "workflows": 0 + }, + "tags": [ + "security", + "governance", + "compliance", + "appsec", + "threat-modeling" + ], + "verified": false + } + } } diff --git a/docs/community/bundles.md b/docs/community/bundles.md index 5eea42ff8f..4ed15e0d36 100644 --- a/docs/community/bundles.md +++ b/docs/community/bundles.md @@ -9,6 +9,7 @@ Accepted community bundle entries are published in [`bundles/catalog.community.j | Bundle | Purpose | Role or team | Provides | Required catalogs | URL | |--------|---------|--------------|----------|-------------------|-----| +| SicarioSpec Security & Governance Bundle | Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates. | `security-engineer` | 1 extension, 11 presets | Documented | [sicario-spec](https://github.com/dfirs1car1o/sicario-spec) | ## What to Submit