From 4996425dffbe4fe2e3ee2e7ab450086c82859c4d Mon Sep 17 00:00:00 2001 From: Scott Converse Date: Mon, 4 May 2026 23:21:50 -0600 Subject: [PATCH 1/2] chore: stage civiccore v0.22.1 attested baseline --- CHANGELOG.md | 2 ++ README.md | 15 ++++++++++----- civiccore/__init__.py | 2 +- docs/index.html | 18 ++++++++++-------- docs/ops/release-signing.md | 23 +++++++++++++++++++++++ pyproject.toml | 2 +- tests/test_smoke.py | 2 +- 7 files changed, 48 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bb8082c..714adf3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,8 @@ MINOR; bug fixes ship as PATCH. ## [Unreleased] +## [0.22.1] - 2026-05-05 + ### Added - `civiccore.release_provenance` now provides the canonical CivicSuite release-provenance gate for the Sigstore attestation trust model, including diff --git a/README.md b/README.md index 30498c6..538d4e5 100644 --- a/README.md +++ b/README.md @@ -61,7 +61,10 @@ by downstream modules until they ship. ## Status -**v0.22.0 is the current development-line release.** This line adds a shared +**v0.22.1 is staged as the first attested baseline release.** This line adds +the canonical Sigstore release-provenance helper, versioned attestation schema, +fixture-driven gate, and tag-driven release workflow that signs and verifies +`release-attestation.json` before publication. It also carries the shared connector source-list status projection that combines circuit health, active failure counts, pause state, actionable operator copy, and next-run calculation for module workspaces on top of shared cron schedule validation helpers for @@ -113,10 +116,10 @@ shared-schema baseline extracted from CivicRecords AI). ## Install -From the current GitHub release wheel (`v0.22.0`, once published): +From the current GitHub release wheel (`v0.22.1`, once published): ```bash -pip install https://github.com/CivicSuite/civiccore/releases/download/v0.22.0/civiccore-0.22.0-py3-none-any.whl +pip install https://github.com/CivicSuite/civiccore/releases/download/v0.22.1/civiccore-0.22.1-py3-none-any.whl ``` Each GitHub release also publishes `SHA256SUMS.txt` alongside the wheel and @@ -133,7 +136,9 @@ signal only; use `scripts/verify-release-provenance.py` and `docs/ops/release-signing.md` for release-tag provenance. The current public `v0.22.0` release is in the Tier 1 correction window because -its tag is lightweight. Do not republish, mirror, or rely on it as the corrected +it predates the Sigstore attestation baseline. Treat `v0.22.1` as the staged +baseline release candidate until the release workflow publishes its attestation +and bundle. Do not republish, mirror, or rely on `v0.22.0` as the corrected provenance baseline until the Tier 1 correction is complete. For development from a clone: @@ -516,7 +521,7 @@ Extraction Spec** in Every CivicSuite module's README declares its CivicCore dependency contract. Current v0.1.0 module foundations pin older civiccore lines. Production-depth -consumers can move to `==0.22.0` once the release is published and the +consumers can move to `==0.22.1` once the release is published and the compatibility matrix is updated. The suite-wide compatibility matrix — which module versions work with which CivicCore versions — is maintained at [CivicSuite/civicsuite/docs/compatibility/](https://github.com/CivicSuite/civicsuite/tree/main/docs/compatibility). diff --git a/civiccore/__init__.py b/civiccore/__init__.py index b7421d5..8251147 100644 --- a/civiccore/__init__.py +++ b/civiccore/__init__.py @@ -14,7 +14,7 @@ from __future__ import annotations -__version__ = "0.22.0" +__version__ = "0.22.1" from civiccore.audit import ( AuditActor, diff --git a/docs/index.html b/docs/index.html index dc38422..ae0f4ea 100644 --- a/docs/index.html +++ b/docs/index.html @@ -3,8 +3,8 @@ - -CivicCore v0.22.0 - CivicSuite shared platform library + +CivicCore v0.22.1 - CivicSuite shared platform library