Releases
The current release is v1.0.0. Releases are tags on
the public repository; each tag runs make check against the
tagged tree, builds the image to ghcr.io/septagon-oss/platformkit with an
SBOM, and publishes a GitHub release with generated notes and the image digest.
CHANGELOG.md records what changed;
RELEASE.md is the runbook.
What a tag means
A tag is an owner’s action after make check and make e2e are green on the
commit and the ceilings in loc-budget.json have been re-ratcheted to the
count rounded up to the next hundred. A successful build is not evidence of a
deployed service; the image digest and the receiving environment are verified
separately.
Consumers
A releasable private consumer pins a published version of the public module.
During development its go.mod may select a sibling checkout through
replace; a build that succeeds with the replacement does not validate the
version named in require, so the consumer’s own release procedure tests the
published dependency without a machine-local path. Each migration owner
numbers its own history; there are no global version ranges across
repositories (ADR 0009 and ADR 0011).
The 0.x line
The platformkit module path once held a CLI scaffolder, released through
v0.15.1. It is superseded, not maintained, and kept reachable under the
repository’s legacy-0.x branch and v0.x tags so that forks of it diverge
cleanly. The pk-* repositories that accompanied it are archived read-only;
what survived of them is inside v1 (ui/, design/, kit/problem), with
attribution in NOTICE.
Reporting a vulnerability
SECURITY.md names the private reporting path and
the three areas the design puts its weight on.