From 89545168d5600277e508613f5753b54ec426680e Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Sat, 8 Aug 2026 01:51:22 -0700 Subject: [PATCH 1/2] fix(oscfg): unwrap 1.4.3 exec resource arrays Normalize object, singleton-array, and wrapped-array CLI responses so pre-deploy audits can evaluate direct CSP, Registry, Test, and UserRights reads from oscfg 1.4.3. Preserve multi-item list mode and reject ambiguous multi-item single-resource calls. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 --- packages/core/src/oscfg/exec.test.ts | 141 +++++++++++++++++++++++++++ packages/core/src/oscfg/exec.ts | 31 +++++- packages/core/src/oscfg/get.ts | 8 +- 3 files changed, 175 insertions(+), 5 deletions(-) diff --git a/packages/core/src/oscfg/exec.test.ts b/packages/core/src/oscfg/exec.test.ts index 460658b..a6cfb3c 100644 --- a/packages/core/src/oscfg/exec.test.ts +++ b/packages/core/src/oscfg/exec.test.ts @@ -72,6 +72,147 @@ describe('serializeProperties', () => { }); }); +describe('execResource response normalization', () => { + it('preserves the object returned by oscfg 1.3.x', async () => { + const resource = { + name: 'registry', + type: 'Microsoft.Windows/Registry', + properties: { value: 1 }, + }; + runOscfgMock.mockResolvedValueOnce({ + success: true, + data: resource, + error: null, + exitCode: 0, + }); + + const result = await execResource({ + mode: 'get', + type: resource.type, + properties: { + keyPath: 'HKLM:\\Software\\ConfigForge', + valueName: 'Enabled', + valueType: 'REG_DWORD', + value: 1, + }, + }); + + expect(result.data).toEqual(resource); + }); + + it('unwraps the single-item array returned by oscfg 1.4.3', async () => { + const resource = { + name: 'csp', + type: 'Microsoft.Windows/CSP', + properties: { value: 1 }, + }; + runOscfgMock.mockResolvedValueOnce({ + success: true, + data: [resource], + error: null, + exitCode: 0, + }); + + const result = await execResource({ + mode: 'get', + type: resource.type, + properties: { + path: './Vendor/MSFT/Policy/Config/Test/Setting', + type: 'integer', + value: 1, + }, + }); + + expect(result).toMatchObject({ + success: true, + data: resource, + error: null, + exitCode: 0, + }); + }); + + it('returns null data for an empty direct exec response', async () => { + runOscfgMock.mockResolvedValueOnce({ + success: true, + data: [], + error: null, + exitCode: 0, + }); + + const result = await execResource({ + mode: 'get', + type: 'Microsoft.Windows/CSP', + properties: { + path: './Vendor/MSFT/Policy/Config/Test/Setting', + type: 'integer', + value: 1, + }, + }); + + expect(result).toMatchObject({ + success: true, + data: null, + error: null, + exitCode: 0, + }); + }); + + it('rejects ambiguous multi-resource exec responses', async () => { + runOscfgMock.mockResolvedValueOnce({ + success: true, + data: [ + { name: 'first', type: 'Microsoft.Windows/CSP', properties: {} }, + { name: 'second', type: 'Microsoft.Windows/CSP', properties: {} }, + ], + error: null, + exitCode: 0, + }); + + const result = await execResource({ + mode: 'get', + type: 'Microsoft.Windows/CSP', + properties: { + path: './Vendor/MSFT/Policy/Config/Test/Setting', + type: 'integer', + value: 1, + }, + }); + + expect(result).toMatchObject({ + success: false, + data: null, + error: 'oscfg exec resource returned 2 resources; expected exactly one', + exitCode: 0, + }); + }); + + it('preserves multi-resource responses for list mode', async () => { + const resources = [ + { name: 'first', type: 'Microsoft.Windows/Firmware', properties: {} }, + { name: 'second', type: 'Microsoft.Windows/Firmware', properties: {} }, + ]; + runOscfgMock.mockResolvedValueOnce({ + success: true, + data: resources, + error: null, + exitCode: 0, + }); + + const result = await execResource({ + mode: 'list', + type: 'Microsoft.Windows/Firmware', + properties: {}, + }); + + expect(result).toMatchObject({ + success: true, + data: resources, + error: null, + exitCode: 0, + }); + }); +}); + describe('execResource Registry normalization', () => { it('sends canonical REG_DWORD for direct Dword input', async () => { await execResource({ diff --git a/packages/core/src/oscfg/exec.ts b/packages/core/src/oscfg/exec.ts index 124eb48..cfd21f4 100644 --- a/packages/core/src/oscfg/exec.ts +++ b/packages/core/src/oscfg/exec.ts @@ -4,6 +4,7 @@ import { runOscfg } from './runner'; import { stringifyLosslessJson } from '../manifest/lossless'; import { normalizeManifestRegistryTypes } from './registry-types'; +import { normalizeOscfgArray } from './get'; import type { OscfgExecOptions, OscfgResource, OscfgResult } from './types'; /** @@ -30,9 +31,18 @@ import type { OscfgExecOptions, OscfgResource, OscfgResult } from './types'; * files. Verified provider versions can accept `Dword` with exit code 0 while * leaving the registry unchanged. */ +export function execResource( + opts: OscfgExecOptions & { mode: 'list' }, +): Promise>; +export function execResource( + opts: OscfgExecOptions & { mode: Exclude }, +): Promise>; +export function execResource( + opts: OscfgExecOptions, +): Promise>; export async function execResource( opts: OscfgExecOptions, -): Promise> { +): Promise> { const properties = maybeNormalizeRegistryProps(opts.type, opts.properties); const propString = serializeProperties(properties); const args = [ @@ -51,7 +61,24 @@ export async function execResource( } args.push('--output', 'json'); - return runOscfg(args, { timeoutMs: opts.timeoutMs }); + const result = await runOscfg(args, { timeoutMs: opts.timeoutMs }); + if (!result.success) return { ...result, data: null }; + + // oscfg 1.3.x emits one object for direct exec calls, while 1.4.3 emits a + // single-item array. Normalize both shapes before the audit fallback reads + // compliance or provider values. + const resources = normalizeOscfgArray(result.data); + if (opts.mode === 'list') return { ...result, data: resources }; + if (resources.length === 0) return { ...result, data: null }; + if (resources.length > 1) { + return { + ...result, + success: false, + data: null, + error: `oscfg exec resource returned ${resources.length} resources; expected exactly one`, + }; + } + return { ...result, data: resources[0] }; } /** diff --git a/packages/core/src/oscfg/get.ts b/packages/core/src/oscfg/get.ts index 114ca5b..4350815 100644 --- a/packages/core/src/oscfg/get.ts +++ b/packages/core/src/oscfg/get.ts @@ -27,7 +27,7 @@ export async function getNamespaces( ); if (!result.success) return { ...result, data: null }; - const raw = normalizeArray(result.data); + const raw = normalizeOscfgArray(result.data); const namespaces: OscfgNamespace[] = raw.map((entry) => { if (typeof entry === 'string') return { name: entry }; if (entry && typeof entry === 'object') { @@ -76,7 +76,7 @@ export async function getResources( }; } - return { ...result, data: normalizeArray(result.data) }; + return { ...result, data: normalizeOscfgArray(result.data) }; } /** @@ -95,8 +95,10 @@ export async function getResourceByName( /** * Helper: the CLI may return a single object or an array depending on args. * Always coerce to array for consistent handling. + * + * @internal */ -function normalizeArray(raw: unknown): T[] { +export function normalizeOscfgArray(raw: unknown): T[] { if (raw === null || raw === undefined) return []; if (Array.isArray(raw)) return raw as T[]; if (typeof raw === 'object') { From 2d890f89b99d32748d07d5968c4ca025a8cb4878 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Sat, 8 Aug 2026 02:02:18 -0700 Subject: [PATCH 2/2] chore(release): prepare v0.3.102 Publish the OSConfig 1.4.3 pre-deploy Audit compatibility fix and align Windows/Linux and macOS Author release references across package metadata and public documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 --- AGENTS.md | 18 ++++++++---------- CHANGELOG.md | 10 ++++++++++ INSTALL.md | 16 +++++++--------- README.md | 18 ++++++++++-------- SECURITY.md | 4 ++-- apps/desktop/PACKAGING.md | 2 +- apps/desktop/package.json | 2 +- docs/src/architecture/system-overview.md | 2 +- docs/src/changelog.md | 7 +++++++ docs/src/introduction.md | 8 ++++---- docs/src/operations/ci.md | 12 ++++++------ docs/src/quick-start/install-run.md | 8 ++++---- package-lock.json | 6 +++--- package.json | 2 +- scripts/release-metadata.test.mjs | 4 ++-- 15 files changed, 67 insertions(+), 52 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 9f4ae39..2b87d92 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -19,13 +19,12 @@ The following release references were verified on 2026-08-06: | Line | Reference | State | |---|---|---| -| `main` | `v0.3.101` | Current Windows/Linux release. It clears the remaining GitHub security alerts after the v0.3.100 js-yaml hotfix. | -| `mac-author-build` | `mac-v0.3.98-author.1` | Current author-only macOS tagged source. The matching GitHub release is a draft and unpublished with the same public documentation corrections. | +| `main` | `v0.3.102` | Current Windows/Linux release. It fixes pre-deploy Audit compatibility with OSConfig 1.4.3 single-resource array responses. | +| `mac-author-build` | `mac-v0.3.101-author.1` | Current author-only macOS release, published as a prerelease with the compatible baseline, authoring, packaging, and security fixes. | On `mac-author-build`, the root package, desktop package, and lockfile records -use `0.3.98-author.1`. The current macOS Author tagged source is -`mac-v0.3.98-author.1`, and its matching GitHub release remains a draft and -unpublished. The Full-edition package versions are `0.3.101`; do not copy +use `0.3.101-author.1`. The current macOS Author release is +`mac-v0.3.101-author.1`. The Full-edition package versions are `0.3.102`; do not copy macOS package metadata to `main`. ### Current feature inventory @@ -449,12 +448,11 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann errors, the desktop build, and a production audit with 0 vulnerabilities. - Historical `0.3.93-author.1` and `0.3.93-author.2` validation records are superseded; their tags/releases no longer exist. Use the current - `mac-v0.3.98-author.1` unpublished draft release metadata and current GitHub + `mac-v0.3.101-author.1` prerelease metadata and current GitHub checks as the authority for macOS Author build and asset status. -- The current macOS Author tagged source is `mac-v0.3.98-author.1`, with an - unpublished draft release. Use current GitHub checks and release metadata - as the authority for build and asset status rather than recording a merge - SHA or workflow run here. +- The current macOS Author release is `mac-v0.3.101-author.1`. Use current + GitHub checks and release metadata as the authority for build and asset + status rather than recording a merge SHA or workflow run here. --- diff --git a/CHANGELOG.md b/CHANGELOG.md index 3f12a44..9f45026 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## [0.3.102] - 2026-08-08 + +### Fixed + +- Normalize single-resource array responses from OSConfig 1.4.3 direct + `exec resource` calls. Pre-deploy Audit now evaluates CSP, Registry, Test, + and User Rights resources instead of reporting them as indeterminate or + "could not read" solely because the CLI returned `[resource]` rather than + `resource`. + ## [Unreleased] ## [0.3.101] - 2026-08-07 diff --git a/INSTALL.md b/INSTALL.md index e8dc7ed..6b278aa 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -8,10 +8,10 @@ ConfigForge has two editions: and Audit Pack export are available. Device Deploy, Audit, and Revert are intentionally omitted. -The current Windows/Linux release is `v0.3.101`. The current macOS Author tagged source is -`mac-v0.3.98-author.1`, and its matching GitHub release is also a draft and -unpublished. The package versions are `0.3.101` for the Full edition and -`0.3.98-author.1` for the macOS Author edition. +The current Windows/Linux release is `v0.3.102`. The current macOS Author +release is `mac-v0.3.101-author.1`; both are published as prereleases. The +package versions are `0.3.102` for the Full edition and `0.3.101-author.1` +for the macOS Author edition. ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source. @@ -127,12 +127,10 @@ later). The release contains an ARM64-only binary. It is not an x64 or universal build and does not support Intel Macs. Rosetta does not provide ARM64-on-Intel compatibility. -The current macOS Author tagged source is `mac-v0.3.98-author.1`. Its matching -GitHub release is a draft and is not available from the public +The current macOS Author release is `mac-v0.3.101-author.1`, published as a +prerelease on the [Azure/ConfigForge releases](https://github.com/Azure/ConfigForge/releases) -page until a maintainer publishes it. Users can build the tagged source by -following the instructions in the -[Azure/ConfigForge repository](https://github.com/Azure/ConfigForge). +page. Users can also build the tagged source from the repository. The app is unsigned and not notarized. Copy **ConfigForge Author.app** to `/Applications`, then clear the browser-added quarantine attribute once: diff --git a/README.md b/README.md index 3da6f16..7eca151 100644 --- a/README.md +++ b/README.md @@ -6,10 +6,10 @@ > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps. -The current Windows/Linux release is `v0.3.101`. The current macOS Author tagged source is -`mac-v0.3.98-author.1`, and its matching GitHub release is also a draft and -unpublished. The package versions are `0.3.101` for the Full edition and -`0.3.98-author.1` for the macOS Author edition. +The current Windows/Linux release is `v0.3.102`. The current macOS Author +release is `mac-v0.3.101-author.1`; both are published as prereleases. The +package versions are `0.3.102` for the Full edition and `0.3.101-author.1` +for the macOS Author edition. ## Export to Azure Machine Configuration @@ -250,11 +250,13 @@ is not a universal binary. | Version | Highlights | |---|---| -| **0.3.101** (current Windows/Linux release) | Clears the remaining GitHub security alerts with patched DOMPurify, fast-uri, ip-address, React Router, and Undici releases | +| **0.3.102** (current Windows/Linux release) | Fixes pre-deploy Audit with OSConfig 1.4.3 so single-resource CSP, Registry, Test, and User Rights reads are evaluated instead of reported as indeterminate | +| **0.3.101** (prior Windows/Linux release) | Clears the remaining GitHub security alerts with patched DOMPurify, fast-uri, ip-address, React Router, and Undici releases | | **0.3.100** (prior Windows/Linux release) | Updates js-yaml to the patched 4.3.1 release for `GHSA-5p4m-2wfm-xmqj` | | **0.3.99** (prior Windows/Linux release) | Verifies Enforce results, preserves exact QWords, keeps Revert safe, repairs WS2022 readability, and adds Machine Configuration Set compatibility | | **0.3.98** (prior Windows/Linux release) | Adds complete Machine Configuration deployment documentation and removes stale/internal public-doc guidance | -| **0.3.98-author.1** (current macOS tagged source; draft unpublished) | Ports the same public documentation and Machine Configuration guidance to macOS Author | +| **0.3.101-author.1** (current macOS prerelease) | Ports the author-safe baseline, lossless data, Machine Configuration packaging, build, and security fixes | +| **0.3.98-author.1** (prior macOS prerelease) | Ports the public documentation and Machine Configuration guidance to macOS Author | | **0.3.97** (prior Windows/Linux draft) | Preserves authoritative CLI reasons for expression-backed Test resources and adds detailed templates to all WS2025 controls | | **0.3.97-author.1** (prior macOS draft) | Ports the same detailed audit-reason behavior to the author-only macOS line | | **0.3.96** (prior Windows/Linux draft) | Preserves all 320/321/296 WS2025 controls while fixing Registry/CSP contracts and CEL compliance, and hardens Machine Configuration MOF export in PR #104 | @@ -262,8 +264,8 @@ is not a universal binary. | **0.3.95** (prior Windows/Linux draft) | Replaces unreliable native hover titles with FluentUI tooltips on My Baselines status cells (keyboard accessible, ARIA-exposed multiline details) in PR #100; corrects documentation architecture and release-state drift in PR #97 | | **0.3.94** (prior Full edition) | Excludes CIS benchmark source data from public installers, publishes the public licensing/privacy/support/security policy surface, patches dev-only `brace-expansion` 5.x, and refreshes nine README screenshots with synthetic benchmark content in PR #89 | | **0.3.94-author.1** (prior macOS draft) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations | -| **0.3.93-author.2** (historical macOS source milestone; no current tag or release) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83/#84. Historical workflow evidence is superseded by the current `mac-v0.3.98-author.1` draft release metadata. | -| **0.3.93-author.1** (historical macOS source milestone; no current tag or release) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77. Historical workflow evidence is superseded by the current `mac-v0.3.98-author.1` draft release metadata. | +| **0.3.93-author.2** (historical macOS source milestone; no current tag or release) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83/#84. Historical workflow evidence is superseded by the current `mac-v0.3.101-author.1` prerelease metadata. | +| **0.3.93-author.1** (historical macOS source milestone; no current tag or release) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77. Historical workflow evidence is superseded by the current `mac-v0.3.101-author.1` prerelease metadata. | | **0.3.93** (prior Full edition) | Adds nested Enter/Tab editing and repairs standalone Windows Server 2025 audits, CIS mapping, and Matrix Diff policy identity handling | | **0.3.92** | Patches the desktop updater, AppImage packager, PostCSS processor, and archive toolchain against newly disclosed vulnerabilities | | **0.3.91** | Shows stacked Test schema rules in Visual mode and enforces supported constraints on newly edited values | diff --git a/SECURITY.md b/SECURITY.md index 488a0ba..d744d26 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged source lines. | Edition | Current version | Security updates | | --- | --- | --- | -| Full edition for Windows and Linux | `v0.3.101` | Supported release | -| macOS Author edition | `mac-v0.3.98-author.1` | Supported tagged source; release remains a draft | +| Full edition for Windows and Linux | `v0.3.102` | Supported published prerelease | +| macOS Author edition | `mac-v0.3.101-author.1` | Supported published prerelease | | Older versions | Earlier tags | Not supported | ## Security scope diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md index 55e80de..f168730 100644 --- a/apps/desktop/PACKAGING.md +++ b/apps/desktop/PACKAGING.md @@ -9,7 +9,7 @@ > flavor lives on the `mac-author-build` branch and uses its own > `electron-builder.author.yml`. > -> **Current through v0.3.101:** the release pipeline generates a +> **Current through v0.3.102:** the release pipeline generates a > CycloneDX SBOM per platform, enforces > `npm audit --omit=dev --audit-level=high` as a release gate, > pins `electron-builder` invocation via `npx --no-install`, and diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 04b0bb5..a98c9fa 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -1,6 +1,6 @@ { "name": "@configforge/desktop", - "version": "0.3.101", + "version": "0.3.102", "private": true, "description": "ConfigForge \u2014 OSConfig Baseline Editing tool", "main": "./dist/electron/main.js", diff --git a/docs/src/architecture/system-overview.md b/docs/src/architecture/system-overview.md index ead0e76..b81e0fc 100644 --- a/docs/src/architecture/system-overview.md +++ b/docs/src/architecture/system-overview.md @@ -1,6 +1,6 @@ # System overview -ConfigForge **0.3.101** is an Electron desktop app for authoring, validating, comparing, and deploying/auditing OSConfig manifests (`.osc.yaml`). The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package. +ConfigForge **0.3.102** is an Electron desktop app for authoring, validating, comparing, and deploying/auditing OSConfig manifests (`.osc.yaml`). The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package. There is no HTTP server, database, queue, or microservice layer in the current app. Renderer code calls the Electron preload bridge (`window.cfs.*`), the main process validates IPC payloads, and pure handlers in `packages/core` own filesystem and CLI operations. diff --git a/docs/src/changelog.md b/docs/src/changelog.md index 46dfc81..f227381 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -6,6 +6,13 @@ foundational work by theme. ## Unreleased +## v0.3.102 - 2026-08-08 + +- **OSConfig 1.4.3 audit compatibility:** Pre-deploy Audit now unwraps the + CLI's single-resource array response so CSP, Registry, Test, and User Rights + resources produce real compliance results instead of false "could not read" + outcomes. + ## v0.3.101 — 2026-08-07 - **Dependency security:** Update DOMPurify, fast-uri, ip-address, React diff --git a/docs/src/introduction.md b/docs/src/introduction.md index 6f16dce..ee19d88 100644 --- a/docs/src/introduction.md +++ b/docs/src/introduction.md @@ -20,10 +20,10 @@ application** with two editions: and elevation methods under `system`) are intentionally omitted. Authors deploy later from the Full edition on Windows or Linux. -The current Windows/Linux release is `v0.3.101`. The current macOS Author tagged source is -`mac-v0.3.98-author.1`, and its matching GitHub release is also a draft and -unpublished. The package versions are `0.3.101` for the Full edition and -`0.3.98-author.1` for the macOS Author edition. +The current Windows/Linux release is `v0.3.102`. The current macOS Author +release is `mac-v0.3.101-author.1`; both are published as prereleases. The +package versions are `0.3.102` for the Full edition and `0.3.101-author.1` +for the macOS Author edition. If you've ever maintained a security baseline by editing GPO templates, exporting Defender for Endpoint settings to a spreadsheet, or copy-pasting between half a dozen runbooks - this app is for you. diff --git a/docs/src/operations/ci.md b/docs/src/operations/ci.md index fedeb0f..5189460 100644 --- a/docs/src/operations/ci.md +++ b/docs/src/operations/ci.md @@ -71,7 +71,7 @@ the immutable macOS tag: gh workflow run "Release (macOS author)" \ --repo Azure/ConfigForge \ --ref main \ - -f release_tag=mac-v0.3.98-author.1 + -f release_tag=mac-v0.3.101-author.1 ``` The target draft release and tag must already exist. The workflow loads its @@ -79,17 +79,17 @@ definition from `main`, checks out `release_tag`, verifies that `HEAD` resolves to the tag, checks that tagged tree with the dependency-free public-asset guard from protected `main`, then builds with `electron-builder.author.yml`. -The `mac-v0.3.98-author.1` release contract expects exactly these assets: +The `mac-v0.3.101-author.1` release contract expects exactly these assets: -1. `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg` -2. `ConfigForge-Author-0.3.98-author.1-mac-arm64.dmg.blockmap` +1. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg` +2. `ConfigForge-Author-0.3.101-author.1-mac-arm64.dmg.blockmap` 3. `latest-mac.yml` 4. `sbom-macos-author.cdx.json` 5. `SHA256SUMS-macos-author.txt` The workflow refuses a published release and never publishes automatically. -For `mac-v0.3.98-author.1`, use the current GitHub checks and draft release as -the authority for actual build and asset status. +For `mac-v0.3.101-author.1`, use the current GitHub checks and published +prerelease as the authority for actual build and asset status. ## Linux runner notes diff --git a/docs/src/quick-start/install-run.md b/docs/src/quick-start/install-run.md index 600660b..9985d7d 100644 --- a/docs/src/quick-start/install-run.md +++ b/docs/src/quick-start/install-run.md @@ -8,10 +8,10 @@ Benchmark Mapping, history, rationale, and Audit Pack export while omitting device operations. The native `oscfg` CLI is **not bundled** and is **not required** for authoring in either edition. -The current Windows/Linux release is `v0.3.101`. The current macOS Author tagged source is -`mac-v0.3.98-author.1`, and its matching GitHub release is also a draft and -unpublished. The package versions are `0.3.101` for the Full edition and -`0.3.98-author.1` for the macOS Author edition. +The current Windows/Linux release is `v0.3.102`. The current macOS Author +release is `mac-v0.3.101-author.1`; both are published as prereleases. The +package versions are `0.3.102` for the Full edition and `0.3.101-author.1` +for the macOS Author edition. ## Prerequisites diff --git a/package-lock.json b/package-lock.json index 0e1e84e..c65d930 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "configforge", - "version": "0.3.101", + "version": "0.3.102", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "configforge", - "version": "0.3.101", + "version": "0.3.102", "hasInstallScript": true, "license": "MIT", "workspaces": [ @@ -34,7 +34,7 @@ }, "apps/desktop": { "name": "@configforge/desktop", - "version": "0.3.101", + "version": "0.3.102", "license": "MIT", "dependencies": { "@fluentui/react-components": "^9.73.8", diff --git a/package.json b/package.json index 4a53ae1..b049796 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "configforge", - "version": "0.3.101", + "version": "0.3.102", "private": true, "license": "MIT", "description": "ConfigForge \u2014 Cross-platform Electron desktop app for OSConfig security baseline authoring", diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs index 582f437..1ae43d7 100644 --- a/scripts/release-metadata.test.mjs +++ b/scripts/release-metadata.test.mjs @@ -196,8 +196,8 @@ describe('public release metadata', () => { expect(contributing).toContain('creates immutable release tags and draft'); expect(support).toContain('The current repository maintainer is'); expect(readme).toContain('for ownership, active-branch, review, release, and cherry-pick guidance'); - expect(security).toContain('v0.3.98'); - expect(security).toContain('mac-v0.3.98-author.1'); + expect(security).toContain('v0.3.102'); + expect(security).toContain('mac-v0.3.101-author.1'); expect(security).toContain('Microsoft Security Response Center'); expect(security).toContain('Microsoft OSConfig project'); expect(support).toContain('best-effort basis');