Security Release Checklist

Use this checklist before cutting any new release (e.g., v0.x.x) to ensure supply-chain integrity.

1. Supply Chain & Installer

Checkbox Pinned Version: Update install.sh VERSION variable to match the release tag.
Checkbox Docs Sync: Ensure README.md and .github/PULL_REQUEST_TEMPLATE.md installer URLs point to the new tag (not main).
Checkbox Clean Build: Verify install.sh does not curl random scripts from third parties without pinning.
Checkbox SOUP Register: Review SOUP_REGISTER.md and confirm all active external components have an owner and validation path.

Checkbox SSH Keys: Scan dot_ssh/ to ensure no private keys (id_rsa, id_ed25519) are committed.
Checkbox Env Vars: Check for hardcoded API tokens in dot_config/ (use age encryption or environment variables instead).
Checkbox Git History: Run git secrets or similar to scan for accidental commits of credentials.

Checkbox WSL Check: Verify install.sh detects WSL and does not try to install systemd services or macOS defaults.
Checkbox Root usage: Ensure no script requires sudo unnecessarily (Principle of Least Privilege).

Checkbox Binary Integrity: Check that dot_local/bin/ scripts are pure shell/executable and match expected checksums (no binary blobs).
Checkbox Dependency Scan: Run npm audit / cargo audit if applicable (currently Node.js legacy is removed).

Checkbox Launcher Policy: Verify dot mcp shows only allowlisted launchers (npx, node, uvx).
Checkbox Filesystem Scope: Ensure no MCP server has broad access (/, /home, /Users).
Checkbox Default Profile: Confirm only the strict-local server set is enabled by default.
Checkbox Token Validation: Confirm required API tokens are set (GITHUB_TOKEN, BRAVE_API_KEY).
Checkbox Arg Policy: No wildcard (*) or --unsafe arguments in MCP server configs.
Checkbox Env Placeholders: All ${VAR} references in MCP config have corresponding environment variables.

Run dot mcp --strict --json to validate all MCP server configurations and capture an audit artifact.

Checkbox SBOM Generation: Verify dotfiles-sbom.spdx.json is generated in release workflow.
Checkbox Attestation Signing: Confirm actions/attest-build-provenance signs the release artifacts.
Checkbox Attestation Verification: Verify with gh attestation verify <artifact> --repo sebastienrousseau/dotfiles.
Checkbox Branch Protection: Ensure security-attestation is a required status check on main.
Checkbox Automation Keying: Confirm ACTIONS_BOT_SIGNING_KEY exists and matches the signer in dot_config/git/allowed_signers.

Checkbox Docker Test: Run docker build -f Dockerfile.test . to verify clean install.
Checkbox Doctor: Run dot doctor locally.
Checkbox MCP Check: Run dot mcp to verify MCP configuration.