Skip to content

Complete Envguard remediation record #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
1337lean merged 1 commit into from
Aug 7, 2026
Merged

Complete Envguard remediation record #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion docs/remediation-plan.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,4 +111,10 @@ Repeat explicit/missing-schema and non-finite-number CLI probes on Linux, macOS,
- [x] Schema discovery and the constraint matrix are documented.
- [x] The audited missing-schema command now fails with the intended exit code.
- [x] All native-platform jobs and analyzers pass.
- [ ] A tagged release is verified in full before publication.
- [x] A tagged release is verified in full before publication.

## Completion evidence

Envguard v0.1.0 was released from protected `main` at `f05fd50bf188773cbe5362fff6c037122f82a86b` after every required CI and CodeQL check passed. The release workflow built the six Linux, macOS, and Windows archives without publishing, independently verified their checksums, contents, executable formats and architectures, and native version output, rejected a deliberately corrupted candidate, attested the verified bytes, and only then published them.

Post-publication verification downloaded the seven public assets, repeated the full distribution check, verified every provenance attestation against `.github/workflows/release.yml`, `refs/tags/v0.1.0`, and the source commit, and confirmed that `go install github.com/1337lean/envguard/cmd/envguard@v0.1.0` reports `v0.1.0`.