Update threat model scope to include release automation #150

New issue

Closed

opened 2026-05-07 15:06:54 -07:00 by jwilger · 0 comments

jwilger commented

2026-05-07 15:06:54 -07:00

Owner

PR #126 review noted that the threat model scope should reflect the release process.

docs/THREAT-MODEL.md already contains detailed release automation threats and assets, including binary release artifacts, RELEASE_SIGNING_KEY, checksum signing, release PATs, and the aarch64 remote builder. However, the ## Scope introduction still says the document covers only the deployed self-hosted review bot.

Update the scope paragraph so it explicitly includes release preparation/publishing automation and binary artifact integrity.

Source feedback: PR #126 comment 7475.

PR #126 review noted that the threat model scope should reflect the release process. `docs/THREAT-MODEL.md` already contains detailed release automation threats and assets, including binary release artifacts, `RELEASE_SIGNING_KEY`, checksum signing, release PATs, and the aarch64 remote builder. However, the `## Scope` introduction still says the document covers only the deployed self-hosted review bot. Update the scope paragraph so it explicitly includes release preparation/publishing automation and binary artifact integrity. Source feedback: PR #126 comment 7475.

jwilger added the

bug

label

2026-05-07 15:07:07 -07:00

jwilger referenced this issue

2026-05-07 15:07:43 -07:00

chore: release v0.3.0 #126

jwilger removed the

bug

label

2026-05-08 11:42:28 -07:00

jwilger added this to the 1.0 milestone