Release Checklist

A repeatable, artifact-first checklist for cutting a T3MP3ST release. The guiding rule is the same as the project itself: every headline number re-derives from committed artifacts — so a release isn't cut until the deterministic gates and the local smoke path are green.

1. Deterministic gates (must all pass)

npm ci
npm run typecheck            # tsc — 0 errors
npm run build                # tsc build
npm run lint                 # 0 errors (warnings OK)
npm test                     # unit + integration suite
npm run verify-claims        # re-derives every headline number from committed artifacts
npm audit                    # expect 0 vulnerabilities
npm run test:no-fitting      # anti-benchmark-fitting guard
npm run test:no-self-fitting
npm run test:no-phantom-tools
npm run test:gate
npm run prompt:audit
npm run pack:dry-run        # inspect the allowlisted package manifest; no workspace/private files

2. Local API smoke (loopback only)

T3MP3ST_PORT=<free-port> npm run server &                 # start on an isolated port
T3MP3ST_PORT=<free-port> npm run smoke                    # health + endpoint smoke
T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run exploit:smoke
T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run field:drill
npm run arsenal:smoke                                     # self-contained, 125 checks

Stop any listeners you started when done.

3. Optional — live checks (network + keys)

npm run smoke -- --live       # exercises a live LLM (needs a provider key or a local agent)
npm run arsenal:doctor        # reports which optional external tools are installed

4. Arsenal prerequisites (optional external tools)

The bash-only path needs no external tools. Specialist operators can use standard offensive tooling if present on PATH; npm run arsenal:doctor reports what's installed. Missing tools degrade gracefully — they never fail the core run.

5. ⚠️ Scope & safety

Never run live scans or exploitation against a target without an explicit authorization / scope receipt. The default posture is owned / local / synthetic targets only.
The server binds 127.0.0.1 by default. If you set T3MP3ST_HOST to a non-loopback address, it prints an EXPOSURE WARNING — the API executes commands and has no built-in auth. Put a Bearer-token reverse proxy in front of it before any LAN / internet exposure.

6. Publish

Confirm the release commit is already on main, CI is green at that exact SHA, the version and changelog agree, and the tag is signed and points to that commit. Never move or reuse a failed release tag; correct the release and use a new version/tag.

Verify repository.url in package.json points at this repo. To retarget it:

npm pkg set repository.url="git+https://github.com/<owner>/<repo>.git"

Tag the release only after Sections 1–2 are green.
Push the v* tag and wait for the tag workflow. It reruns npm run test:release, the high-severity dependency audit, and package dry run against the exact tag. It then creates one deterministic T3MP3ST-<sha>.zip directly from that tested Git object.
The workflow extracts that ZIP into a clean temporary directory, performs a locked install and build, and invokes the packaged CLI help path before the archive can be retained.
Verify release-evidence/source-zip-check.txt, SHA256SUMS, and the retained Sigstore provenance bundle. Workspace notes, secrets, ignored files, and local artifacts cannot enter a git archive snapshot.
Publish the retained, checksum-matched ZIP. Do not rebuild a different archive from another checkout after certification.

3.7 KiB Raw Permalink Blame History Unescape Escape