81 lines
3.7 KiB
Markdown
81 lines
3.7 KiB
Markdown
# Release Checklist
|
||
|
||
A repeatable, artifact-first checklist for cutting a T3MP3ST release. The guiding rule is the
|
||
same as the project itself: **every headline number re-derives from committed artifacts** — so a
|
||
release isn't cut until the deterministic gates and the local smoke path are green.
|
||
|
||
## 1. Deterministic gates (must all pass)
|
||
|
||
```bash
|
||
npm ci
|
||
npm run typecheck # tsc — 0 errors
|
||
npm run build # tsc build
|
||
npm run lint # 0 errors (warnings OK)
|
||
npm test # unit + integration suite
|
||
npm run verify-claims # re-derives every headline number from committed artifacts
|
||
npm audit # expect 0 vulnerabilities
|
||
npm run test:no-fitting # anti-benchmark-fitting guard
|
||
npm run test:no-self-fitting
|
||
npm run test:no-phantom-tools
|
||
npm run test:gate
|
||
npm run prompt:audit
|
||
npm run pack:dry-run # inspect the allowlisted package manifest; no workspace/private files
|
||
```
|
||
|
||
## 2. Local API smoke (loopback only)
|
||
|
||
```bash
|
||
T3MP3ST_PORT=<free-port> npm run server & # start on an isolated port
|
||
T3MP3ST_PORT=<free-port> npm run smoke # health + endpoint smoke
|
||
T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run exploit:smoke
|
||
T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run field:drill
|
||
npm run arsenal:smoke # self-contained, 125 checks
|
||
```
|
||
|
||
Stop any listeners you started when done.
|
||
|
||
## 3. Optional — live checks (network + keys)
|
||
|
||
```bash
|
||
npm run smoke -- --live # exercises a live LLM (needs a provider key or a local agent)
|
||
npm run arsenal:doctor # reports which optional external tools are installed
|
||
```
|
||
|
||
## 4. Arsenal prerequisites (optional external tools)
|
||
|
||
The bash-only path needs **no** external tools. Specialist operators can use standard offensive
|
||
tooling if present on `PATH`; `npm run arsenal:doctor` reports what's installed. Missing tools
|
||
degrade gracefully — they never fail the core run.
|
||
|
||
## 5. ⚠️ Scope & safety
|
||
|
||
- **Never run live scans or exploitation against a target without an explicit authorization /
|
||
scope receipt.** The default posture is owned / local / synthetic targets only.
|
||
- The server binds `127.0.0.1` by default. If you set `T3MP3ST_HOST` to a non-loopback address,
|
||
it prints an **EXPOSURE WARNING** — the API executes commands and has **no built-in auth**. Put
|
||
a Bearer-token reverse proxy in front of it before any LAN / internet exposure.
|
||
|
||
## 6. Publish
|
||
|
||
- Confirm the release commit is already on `main`, CI is green at that exact
|
||
SHA, the version and changelog agree, and the tag is signed and points to that
|
||
commit. Never move or reuse a failed release tag; correct the release and use
|
||
a new version/tag.
|
||
- Verify `repository.url` in `package.json` points at this repo. To retarget it:
|
||
```bash
|
||
npm pkg set repository.url="git+https://github.com/<owner>/<repo>.git"
|
||
```
|
||
- Tag the release only after Sections 1–2 are green.
|
||
- Push the `v*` tag and wait for the tag workflow. It reruns
|
||
`npm run test:release`, the high-severity dependency audit, and package dry
|
||
run against the exact tag. It then creates one deterministic
|
||
`T3MP3ST-<sha>.zip` directly from that tested Git object.
|
||
- The workflow extracts that ZIP into a clean temporary directory, performs a
|
||
locked install and build, and invokes the packaged CLI help path before the
|
||
archive can be retained.
|
||
- Verify `release-evidence/source-zip-check.txt`, `SHA256SUMS`, and the retained
|
||
Sigstore provenance bundle. Workspace notes, secrets, ignored files, and
|
||
local artifacts cannot enter a `git archive` snapshot.
|
||
- Publish the retained, checksum-matched ZIP. Do not rebuild a different
|
||
archive from another checkout after certification.
|