ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions 2

feat: add one-command alpha14 server installation #42

Merged
ochenstarik-ui merged 2 commits from codex/release-alpha14 into main 2026-08-15 15:52:21 +00:00
Conversation 0 Commits 2 Files changed 4 +2 -1
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit c83fd1ea92 - Show all commits

3
docs/release-policy.md
View file

@ -11,7 +11,8 @@ For `v0.1.0-alpha.9`, this makes `smm-setup.sh`, `smm-setup.sh.sha256`, the boot
Known release history:
- `v0.1.0-alpha.8` contains the v1 `server-monitor-manager-bootstrap-manifest.json` layout and an orphaned `server-monitor-manager-manifest.sig` without the corresponding manifest v2. Published assets remain immutable; the anomaly is documented rather than repaired in place.
- Tags `v0.1.0-alpha.10` and `v0.1.0-alpha.11` exist, but their Release pipelines failed before a GitHub Release was published. Those version numbers are burned and must not be moved, deleted, recreated, or reused.
- `v0.1.0-alpha.10` exists as a tag, but its Release pipeline failed before a GitHub Release was published. The version number is burned and must not be moved, deleted, recreated, or reused.
- `v0.1.0-alpha.11` exists as a tag, but its Release pipeline failed before a GitHub Release was published. The version number is burned and must not be moved, deleted, recreated, or reused.
- `v0.1.0-alpha.12` was published with a keyless manifest signature but without the Fulcio signing certificate, so consumers cannot verify that signature. Its Windows `SHA256SUMS` asset also used CRLF and was not consumable by GNU `sha256sum -c`. The immutable release remains published as historical evidence; neither defect is repaired in place.
- `v0.1.0-alpha.13` corrected the checksum portability defect, but it was also published with a keyless manifest signature and without the Fulcio signing certificate required by production consumers. The immutable release remains published as historical evidence; the producer/consumer certificate contract is corrected under a higher version.
- `v0.1.0-alpha.14` is the first release whose contract requires the manifest, keyless signature, and Fulcio certificate to be published and verified together. Its tag may be created only from `main` after the release pull request, required CI, and a branch `workflow_dispatch` dry run of the Release pipeline are green.