feat(build): add centralized version bump script and supply-chain attestation by WilliamBerryiii · Pull Request #1183 · microsoft/hve-core

WilliamBerryiii · 2026-03-24T00:05:43Z

Description

Centralizes the duplicated version-bump logic from release-prerelease-pr.yml and release-stable.yml into a single shared PowerShell script and adds supply-chain attestation (SBOM, Sigstore provenance, in-toto) to the stable release workflow for plugin ZIP artifacts.

Changes

scripts/release/Update-VersionFiles.ps1 — New shared script that updates all five version file types (package.json, extension/templates/package.template.json, .github/plugin/marketplace.json, plugins/*/.github/plugin/plugin.json, .release-please-manifest.json) and runs npm run plugin:generate.
scripts/tests/release/Update-VersionFiles.Tests.ps1 — 13 Pester tests covering helpers, integration, and validation-reject scenarios.
release-prerelease-pr.yml — Replaced ~28 lines of inline jq commands with a single call to the shared PowerShell script.
release-stable.yml — Replaced inline jq version bump with the shared script; added Node.js setup, npm ci, and PowerShell-Yaml prerequisites; added SBOM generation (anchore/sbom-action), build provenance attestation (actions/attest-build-provenance), SBOM attestation (actions/attest), .intoto.jsonl extraction, and a new append-verification-notes job for release notes.
release-prerelease.yml — Added .intoto.jsonl extraction from attestation bundle and upload to GitHub Release.
SECURITY.md — Added plugin ZIP verification example, "Release Artifact Formats" table documenting .spdx.json, .sigstore.json, .intoto.jsonl suffixes, and expanded the "What Gets Signed" table.
.gitignore — Added negation patterns to keep scripts/release/ and scripts/tests/release/ tracked.
.cspell/general-technical.txt — Added DSSE and intoto terms.

Related Issues

Type of Change

Code & Documentation

Infrastructure & Configuration

GitHub Actions workflow
Security configuration
Script/automation
DevContainer, VS Code settings

AI Artifacts

New or updated prompt (.prompt.md)
New or updated agent (.agent.md)
New or updated instruction (.instructions.md)
New or updated skill (SKILL.md)

Other

Chore/maintenance
Other (describe below)

Sample Prompts

N/A — no AI artifact changes.

Testing

13 Pester unit tests in scripts/tests/release/Update-VersionFiles.Tests.ps1 — all passing
Tests cover: Resolve-RepoRoot (supplied, auto-detect, failure), Update-JsonVersion (simple, missing file, nested, dot-key), full script execution (all files, multiple plugins, sparse repo, invalid version rejection)
All lint checks pass (see Required Automated Checks below)

Checklist

Required Checks

My changes follow the project's coding conventions
I have performed a self-review of my changes
I have verified that new and existing tests pass
My changes generate no new warnings or errors

AI Artifact Contributions

I have followed the Prompt Engineering Guidelines
I have tested my prompts thoroughly before submitting
I have read and followed the contribution guidelines
My changes are consistent with the prompt-builder instructions

Required Automated Checks

npm run lint:md — passes
npm run spell-check — passes (304 files, 0 issues)
npm run lint:frontmatter — passes
npm run lint:ps — passes (0 warnings, 0 errors)
npm run validate:skills — not applicable
npm run lint:md-links — not run (network-dependent)
npm run plugin:generate — not applicable (no plugin changes)

Security Considerations

This PR adds supply-chain security features:

Build provenance attestation via actions/attest-build-provenance for plugin ZIP artifacts
SBOM generation via anchore/sbom-action for plugin packages
SBOM attestation via actions/attest linking SBOMs to plugin ZIPs
In-toto extraction (.intoto.jsonl) from Sigstore bundles for both VSIX and plugin artifacts
Verification documentation in SECURITY.md with gh attestation verify examples
New workflow permissions scoped minimally: id-token: write, attestations: write, artifact-metadata: write

Additional Notes

🔧 - Generated by Copilot

github-actions · 2026-03-24T00:08:07Z

Dependency Review Summary

The full dependency review summary was too large to display here (1555KB, limit is 1024KB).

Please download the artifact named "dependency-review-summary" to view the complete report.

View full job summary

codecov-commenter · 2026-03-24T00:08:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.89%. Comparing base (e69486a) to head (d269ced).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1183      +/-   ##
==========================================
- Coverage   86.90%   86.89%   -0.02%     
==========================================
  Files          59       59              
  Lines        8774     8774              
==========================================
- Hits         7625     7624       -1     
- Misses       1149     1150       +1

Flag	Coverage Δ
pester	`85.32% <ø> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

rezatnoMsirhC

LGTM aside from Table Format Check workflow failure

…estation - add shared PowerShell Update-VersionFiles.ps1 replacing inline jq commands - update release workflows to call shared version-bump script - enable supply-chain attestation in release workflows - add attestation verification guidance to SECURITY.md - add Pester tests for Update-VersionFiles.ps1 🔧 - Generated by Copilot

WilliamBerryiii · 2026-03-24T00:15:05Z

LGTM aside from Table Format Check workflow failure

Fix in the pipe and running now. Thanks for the fast turnaround.

## Pre-Release 3.3.1 ### ✨ Features - add centralized version bump script and supply-chain attestation (#1183) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Pre-Release 3.3.10 ### ✨ Features - standardize pytest-mock as Python mocking framework (#1170) - add Jira backlog workflows and Jira/GitLab skills (#978) - add centralized version bump script and supply-chain attestation (#1183) ### 🐛 Bug Fixes - add post-release triggers to scorecard workflow (#1186) - add missing .md extensions to relative links in agent documentation (#1180) ### 🔧 Maintenance - bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group (#1175) - bump the github-actions group with 3 updates (#1176) - pre-release 3.3.1 (#1165) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Pre-Release 3.3.27 ### ✨ Features - standardize pytest-mock as Python mocking framework (#1170) - add Jira backlog workflows and Jira/GitLab skills (#978) - add centralized version bump script and supply-chain attestation (#1183) ### 🐛 Bug Fixes - sync package-lock.json after pre-release version bump (#1236) - separate mermaid node declarations and add dynamic diagram generation with tests (#1215) - replace anchor links in meeting-analyst with bold text references (#1201) - remove recursive symlinks in jira and gitlab skill directories (#1233) - validate-installation scripts now check .github/skills directory (#1010) (#1206) - resolve npm audit vulnerabilities via dependency overrides (#1200) - add post-release triggers to scorecard workflow (#1186) - add missing .md extensions to relative links in agent documentation (#1180) ### ♻️ Refactoring - align agent and prompt folder names to collection identifier (#1210) ### 🔧 Maintenance - bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab (#1234) - bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus (#1226) - bump the github-actions group with 4 updates (#1231) - add missing folders and alphabetize location lists (#1193) - bump brace-expansion (#1224) - bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus (#1217) - bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus (#1213) - pre-release 3.3.10 (#1187) - bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group (#1175) - bump the github-actions group with 3 updates (#1176) - pre-release 3.3.1 (#1165) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Pre-Release 3.3.41 ### ✨ Features - add agentic workflows for automated issue triage, implementation, PR review, dependency review, and doc-staleness detection (#1219) - consolidate package-lock.json version sync into Update-VersionFiles.ps1 (#1240) - add standards code review agent and full review orchestrator (#1174) - standardize pytest-mock as Python mocking framework (#1170) - add Jira backlog workflows and Jira/GitLab skills (#978) - add centralized version bump script and supply-chain attestation (#1183) ### 🐛 Bug Fixes - replace invalid bare tool names with official tool identifiers (#1198) - fix broken links and remove orphaned reference in code review docs (#1257) - exclude Python env dirs from skill validation warnings (#1255) - pin happy-dom and serialize-javascript to resolve Dependabot vulnerabilities (#1253) - remove Mermaid diagram and add missing collection cards (#1247) - disable MCP servers by default to prevent token limit errors (#1144) - sync package-lock.json after pre-release version bump (#1236) - separate mermaid node declarations and add dynamic diagram generation with tests (#1215) - replace anchor links in meeting-analyst with bold text references (#1201) - remove recursive symlinks in jira and gitlab skill directories (#1233) - validate-installation scripts now check .github/skills directory (#1010) (#1206) - resolve npm audit vulnerabilities via dependency overrides (#1200) - add post-release triggers to scorecard workflow (#1186) - add missing .md extensions to relative links in agent documentation (#1180) ### 📚 Documentation - CLI getting-started: clarify plugin install commands as alternatives (-all vs base) (#1251) ### ♻️ Refactoring - align agent and prompt folder names to collection identifier (#1210) ### 🔧 Maintenance - streamline RAI Planner phase structure and documentation (#1273) - bump happy-dom from 20.8.8 to 20.8.9 in /docs/docusaurus (#1237) - pre-release 3.3.27 (#1191) - bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab (#1234) - bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus (#1226) - bump the github-actions group with 4 updates (#1231) - add missing folders and alphabetize location lists (#1193) - bump brace-expansion (#1224) - bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus (#1217) - bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus (#1213) - pre-release 3.3.10 (#1187) - bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group (#1175) - bump the github-actions group with 3 updates (#1176) - pre-release 3.3.1 (#1165) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Pre-Release 3.3.101 ### ✨ Features - add removed maturity tier and retire owasp-docker (#1444) - add evaluation dataset creator (#1279) - align RAI planner with guide, remove scoring, improve UX (#1287) - add PSGallery staleness check and BOM cleanup (#1379) - ISA-95 network planner agent (#1177) - auto-generate collection.md with maturity filtering (#1316) - add folder-consistency check and standardize WARN outp… (#1350) - add synth-data-generate prompt to data-science collection (#1419) - add canonical deck workflow and customer-card rendering for design thinking (#1413) - add Figma MCP integration for DT artifact export (#1222) - introduce `owasp-docker` (#1245) - replace hve-core-specific references with portable discovery-based language (#1335) - introduce `owasp-cicd` (#1246) - add secure-by-design knowledge skill (#1223) - introduce `owasp-infrastructure` (#1244) - introduce `owasp-mcp` (#1207) - add OutputPath parameter to Invoke-LinkLanguageCheck.ps1 (#1229) - add -OutputPath parameter to Validate-SkillStructure.ps1 (#1225) - add maintainer-only skip-review label guard (#1293) - add extension collections overview and integrate into getting started flow (#950) - add agentic workflows for automated issue triage, implementation, PR review, dependency review, and doc-staleness detection (#1219) - consolidate package-lock.json version sync into Update-VersionFiles.ps1 (#1240) - add standards code review agent and full review orchestrator (#1174) - standardize pytest-mock as Python mocking framework (#1170) - add Jira backlog workflows and Jira/GitLab skills (#978) - add centralized version bump script and supply-chain attestation (#1183) ### 🐛 Bug Fixes - pin PowerShell-Yaml to 0.4.7 across all install sites (#1378) - close fork-PR/workflow-file-PR secret-strip gap and normalize upload-artifact version (#1421) - replace stream-based lookahead with array indexing in list-changed-files.sh (#1376) - centralize ISO 8601 timestamp regex in CIHelpers (#1343) - update stale documentation date in release-process.md (#1363) - pin basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr (#1374) - add bot filter to dependency PR review workflow (#1362) - resolve pip-audit findings in powerpoint, gitlab, and jira skill lock files (#1360) - standardize Timestamp JSON key casing across all lint result files (#1314) - add synchronize trigger to PR Review workflow (#1323) - standardize timestamp in Validate-SkillStructure.ps1 to use Get-StandardTimestamp (#1280) - add parallel subagent dispatch and structured JSON contracts to code-review-full (#1304) - standardize timestamp in SecurityHelpers.psm1 to use Get-StandardTimestamp (#1284) - standardize timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1 (#1282) - derive collection artifact counts from YAML at build time (#1275) - standardize timestamp in FrontmatterValidation.psm1 to use Get-StandardTimestamp (#1285) - standardize timestamp in Markdown-Link-Check.ps1 to use Get-StandardTimestamp (#1283) - escape hyphens in Mermaid diagram on Collections page (#1262) - add summary timestamp to PSScriptAnalyzer output (#1211) - fix plugin compatibility and robustness for coding-standards code review agents (#1289) - standardize timestamp in Test-CopyrightHeaders.ps1 to use Get-StandardTimestamp (#1278) - standardize timestamp in Invoke-YamlLint.ps1 to use Get-StandardTimestamp (#1270) - standardize timestamp in Invoke-LinkLanguageCheck.ps1 to use Get-StandardTimestamp (#1264) - fix dependency-review path filters and sparse-checkout cone mode (#1259) - replace invalid bare tool names with official tool identifiers (#1198) - fix broken links and remove orphaned reference in code review docs (#1257) - exclude Python env dirs from skill validation warnings (#1255) - pin happy-dom and serialize-javascript to resolve Dependabot vulnerabilities (#1253) - remove Mermaid diagram and add missing collection cards (#1247) - disable MCP servers by default to prevent token limit errors (#1144) - sync package-lock.json after pre-release version bump (#1236) - separate mermaid node declarations and add dynamic diagram generation with tests (#1215) - replace anchor links in meeting-analyst with bold text references (#1201) - remove recursive symlinks in jira and gitlab skill directories (#1233) - validate-installation scripts now check .github/skills directory (#1010) (#1206) - resolve npm audit vulnerabilities via dependency overrides (#1200) - add post-release triggers to scorecard workflow (#1186) - add missing .md extensions to relative links in agent documentation (#1180) ### 📚 Documentation - broaden Security Review description beyond OWASP (#1385) - document maintainer advisory mode and skip-review label guard (#1386) - document ExcludePaths/OutputPath for Invoke-LinkLanguageCheck (#1383) - CLI getting-started: clarify plugin install commands as alternatives (-all vs base) (#1251) ### ♻️ Refactoring - align agent and prompt folder names to collection identifier (#1210) ### 🔧 Maintenance - pin PSScriptAnalyzer to 1.25.0 and sync stale workflow version comments (#1389) - bump lxml from 6.0.2 to 6.1.0 in /.github/skills/experimental/powerpoint (#1424) - bump @vscode/vsce from 3.7.1 to 3.9.1 in the npm-dependencies group (#1390) - bump the github-actions group across 1 directory with 7 updates (#1391) - bump follow-redirects from 1.15.11 to 1.16.0 in /docs/docusaurus (#1356) - upgrade Node.js from 20 to 24 and bump cspell to v10 (#1353) - bump basic-ftp from 5.2.0 to 5.2.1 (#1324) - update github/gh-aw-actions requirement to 536ea1bad8c6715d098a9dc1afea8d403733acfe in the github-actions group across 1 directory (#1298) - update security instruction attributions and compliance (#1294) - bump the npm-dependencies group with 2 updates (#1297) - pre-release 3.3.41 (#1252) - streamline RAI Planner phase structure and documentation (#1273) - bump happy-dom from 20.8.8 to 20.8.9 in /docs/docusaurus (#1237) - pre-release 3.3.27 (#1191) - bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab (#1234) - bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus (#1226) - bump the github-actions group with 4 updates (#1231) - add missing folders and alphabetize location lists (#1193) - bump brace-expansion (#1224) - bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus (#1217) - bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus (#1213) - pre-release 3.3.10 (#1187) - bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group (#1175) - bump the github-actions group with 3 updates (#1176) - pre-release 3.3.1 (#1165) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

WilliamBerryiii requested a review from a team as a code owner March 24, 2026 00:05

rezatnoMsirhC approved these changes Mar 24, 2026

View reviewed changes

WilliamBerryiii force-pushed the feat/centralized-version-bump branch from 9611967 to d269ced Compare March 24, 2026 00:14

WilliamBerryiii requested review from mattdot March 24, 2026 00:26

auyidi1 approved these changes Mar 24, 2026

View reviewed changes

WilliamBerryiii merged commit 198086b into main Mar 24, 2026
33 checks passed

This was referenced Mar 24, 2026

chore(main): pre-release 3.3.1 #1165

Merged

chore(main): release hve-core 4.0.0 #1184

Open

hve-core-release-please Bot mentioned this pull request Mar 24, 2026

chore(main): pre-release 3.3.10 #1187

Merged

hve-core-release-please Bot mentioned this pull request Mar 25, 2026

chore(main): pre-release 3.3.27 #1191

Merged

WilliamBerryiii mentioned this pull request Mar 30, 2026

Pre-release version bump does not sync package-lock.json #1235

Closed

hve-core-release-please Bot mentioned this pull request Mar 31, 2026

chore(main): pre-release 3.3.41 #1252

Merged

hve-core-release-please Bot mentioned this pull request Apr 2, 2026

chore(main): pre-release 3.3.101 #1274

Merged

hve-core-release-please Bot mentioned this pull request Apr 27, 2026

chore(main): pre-release 4.1.195 #1476

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(build): add centralized version bump script and supply-chain attestation#1183

feat(build): add centralized version bump script and supply-chain attestation#1183
WilliamBerryiii merged 1 commit into
mainfrom
feat/centralized-version-bump

WilliamBerryiii commented Mar 24, 2026

Uh oh!

github-actions Bot commented Mar 24, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Mar 24, 2026 •

edited

Loading

Uh oh!

rezatnoMsirhC left a comment

Uh oh!

WilliamBerryiii commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

WilliamBerryiii commented Mar 24, 2026

Description

Changes

Related Issues

Type of Change

Code & Documentation

Infrastructure & Configuration

AI Artifacts

Other

Sample Prompts

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions Bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review Summary

Uh oh!

codecov-commenter commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

rezatnoMsirhC left a comment

Choose a reason for hiding this comment

Uh oh!

WilliamBerryiii commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Mar 24, 2026 •

edited

Loading

codecov-commenter commented Mar 24, 2026 •

edited

Loading