Release hygiene: fix config drift and close gold-standard gaps

[dean0x]

Rescoped 2026-08-09 against 113f472.

What changed:

• The entire Config drift block is struck — all five items are resolved or tracked elsewhere (details below).
• Item 4 (CODE_OF_CONDUCT.md) is removed from this issue: Add CODE_OF_CONDUCT.md (Contributor Covenant 2.1) #38 remains the actionable standalone issue and is already on Wave 1. It should not be tracked here.
• This issue is now only the Gold-standard gaps checklist.
• Two checklist halves are cross-referenced out: SHA-pinning is tracked in ci: SHA-pin GitHub Actions + assert lockfile version in verify-versions.mjs #163, cargo-deny / license attribution is tracked in ci: add cargo-deny / cargo-audit supply-chain gate #136. They are not part of Release hygiene: fix config drift and close gold-standard gaps #182.

---

An audit used this repo as the reference template for release-readiness of another project. It's a strong template, but some gaps against a "gold standard" release bar surfaced. This issue tracks those remaining gaps.

Config drift — RESOLVED, no longer in scope

All five originally-filed drift items are closed out as of 113f472:

1. Repo homepage points at the wrong slug — satisfied. gh api repos/dean0x/mdscript reports homepage: https://github.com/dean0x/mdscript#readme.
2. .github/ISSUE_TEMPLATE/config.yml links to /discussions while Discussions is disabled — satisfied. No /discussions link remains anywhere in .github/ISSUE_TEMPLATE/ (grep exits 1), and has_discussions: false — so the templates and the repo settings now agree.
3. SECURITY.md supported-versions table is stale (0.1.x) — satisfied. No 0.1.x row remains; SECURITY.md:23-28 now carries the rolling statement instead of a version table, so it can't rot again.
4. CODE_OF_CONDUCT.md still missing — struck from this issue. Tracked standalone in Add CODE_OF_CONDUCT.md (Contributor Covenant 2.1) #38, which is already scheduled on Wave 1. Folding it in here only duplicated the tracking.
5. workflow_dispatch release path broken against protected main (release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127) — satisfied. release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127 is closed, release.yml no longer has a prepare job, and workflow_dispatch: {} is dry-run-only (builds + A3 gate, publishes nothing). The failure mode was designed out in favor of the tag-driven flow.

Gold-standard gaps

The bar used for the audit:

• (a) Every public claim is CI-verified — declared MSRV is checked (✅ already done here), claimed commit conventions are enforced, docs can't silently drift from settings.
• (b) Supply chain — all actions SHA-pinned with Dependabot keeping pins fresh; OIDC trusted publishing (no long-lived registry tokens); npm provenance; cargo-deny gating advisories/licenses.
• (c) Release integrity — checksummed release artifacts + build-provenance attestations; a dry-run path exercising the full build matrix (✅ already done here); idempotent, safely re-runnable publish steps.
• (d) Self-consistency — repo settings, templates, and health files agree with each other (✅ now satisfied — see the resolved drift items above).
• (e) Protection that doesn't fight automation — branch protection with the release path designed around it (✅ now satisfied — tag-driven release).

Against that bar, the remaining work:

• Registry auth uses long-lived secrets (CARGO_REGISTRY_TOKEN, NPM_TOKEN); both crates.io and npm support OIDC trusted publishing — switch, then delete the tokens.
• GitHub Releases carry no artifacts or checksums — attach a SHA256SUMS (and optionally the platform artifacts), and add build-provenance attestations (actions/attest-build-provenance).
• publish-crates waits on the index with sleep 30 between mds-core and mds-cli — replace with a poll of the crates.io index for the exact version.
• Publish failures are downgraded to warnings ("may already exist") — replace with explicit idempotency checks (query the registry for the exact version; skip if present, hard-fail on anything else).
• Conventional Commits are claimed in CONTRIBUTING and the PR template but not enforced — add a PR-title lint or soften the claim.
• Optional: OpenSSF Scorecard workflow + badge; coverage reporting.

Tracked elsewhere — not part of this issue

• Action SHA-pinning (workflow-level uses: floating on major tags; only the composite action's internals are pinned) → ci: SHA-pin GitHub Actions + assert lockfile version in verify-versions.mjs #163.
• cargo-deny / cargo-audit advisory + license gating, and license attribution → ci: add cargo-deny / cargo-audit supply-chain gate #136.

Do not re-add either of those to this checklist; close them in their own issues.

[dean0x]

Reconciliation against main (2026-08-09 sweep) — 10 of 13 still real

Re-verified every claim. Three are now fixed by PR #287 (cb44b56); the rest stand.

Fixed — strike these

• Config drift tech-debt: lower-priority refactorings (call_stack, error strings, exit codes, cycle detection) #5 — workflow_dispatch release path broken against protected main (release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127) — done. chore: harden release machinery (5 independent fixes) #287 Fix 4 deleted the prepare push-to-main job entirely; the workflow now has exactly two entry points (tag push → full release, bare dispatch → dry-run). This is the "design the failure out" resolution this issue recommended. release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127 closed.
• Gold-standard: publish-crates waits with sleep 30 — done. chore: harden release machinery (5 independent fixes) #287 Fix 2 replaced it with a bounded crates.io sparse-index poll (max 20 x 15 s = 5 min, then hard fail). release.yml:190-211.
• Gold-standard: publish failures downgraded to warnings — done. chore: harden release machinery (5 independent fixes) #287 Fix 2 replaced cargo publish || true with an explicit idempotency check: success → proceed; "already uploaded" → notice and continue; anything else → exit 1. release.yml:180-188, :215-223.

Still real — verified today

Config drift (all trivial, all pre-tag):

1. Homepage slug still wrong. gh api repos/dean0x/mdscript --jq .homepage returns https://github.com/dean0x/mds#readme. Should be .../mdscript#readme. One settings edit.
2. Dead /discussions link. has_discussions: false, yet .github/ISSUE_TEMPLATE/config.yml still offers "Question or discussion" pointing at https://github.com/dean0x/mdscript/discussions. Enable Discussions or drop the contact link.
3. SECURITY.md stale support table. Lines 25-30 still read 0.1.x ✅ / < 0.1.0 ❌ — and sit two lines below the rolling statement ("Security fixes are applied to the latest released minor series only") that was meant to replace them. The table now directly contradicts the sentence above it, and it will read as "v0.4.0 unsupported" the moment v0.4.0 ships. Deleting the table is the fix.
4. CODE_OF_CONDUCT.md still missing (Add CODE_OF_CONDUCT.md (Contributor Covenant 2.1) #38, still open on the v0.2.0 milestone).

Gold-standard gaps (all post-tag except as noted):

• OIDC trusted publishing for crates.io + npm; delete CARGO_REGISTRY_TOKEN / NPM_TOKEN.
• SHA-pin workflow-level uses:. Current state: 2 of 49 refs pinned — both inside .github/actions/setup-wasm/ (jetli/wasm-pack-action, phi-ag/setup-binaryen); the other 47 float on major tags. Tracked in detail in ci: SHA-pin GitHub Actions + assert lockfile version in verify-versions.mjs #163.
• Release artifacts: no SHA256SUMS, no actions/attest-build-provenance.
• No cargo-deny/cargo-audit gate — ci: add cargo-deny / cargo-audit supply-chain gate #136.
• Conventional Commits claimed in CONTRIBUTING + PR template but unenforced.
• Optional: OpenSSF Scorecard, coverage.

Recommendation: items 1-4 are minutes of work and are the ones a reader of the v0.4.0 release will actually hit. Do those pre-tag; leave the gold-standard block for v0.5.0.