forkless/NotAlterra
1
0
Fork 0
mirror of https://github.com/forkless/NotAlterra.git synced 2026-08-22 18:49:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

move attestation note from release notes to governance doc, reword

Browse Source
This commit is contained in:
forkless
2026-06-09 23:47:03 +02:00
parent cdfc3e8b0b
commit 40e583777b
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/GOVERNANCE.md
+4
View File
@@ -77,6 +77,10 @@ welcome. Patience is appreciated. Kindness is non-negotiable.
CI now creates releases as drafts — binaries are built and uploaded but
not published. The maintainer tests the draft binaries before publishing.
> SLSA provenance attestation is generated automatically for every
> tagged release. The `.intoto.jsonl` file is included with the
> binaries. No configuration needed.
Before signing a release tag, the maintainer verifies:
- [ ] Impact analysis completed — all call sites for new/changed functions identified and updated