Release Process
Relevant source files
The following files were used as context for generating this wiki page:
The Release Process for the Unified Security Scanner is a structured workflow designed to ensure high-quality, stable, and secure updates to the scanning engine and its associated tools. The process leverages automated CI/CD pipelines to manage versioning, documentation updates, and artifact distribution across supported platforms.
By adhering to a standardized release cycle, the project ensures that new features, such as AI-powered analysis and multi-tool orchestration, are delivered reliably while maintaining an industry-leading false positive rate of less than 5%.
Sources: CONTRIBUTING.md:129-135, README.md:5-15
Release Lifecycle and Automation
Releases are primarily automated via GitHub Actions, which handle the heavy lifting of building, testing, and publishing the software. The lifecycle begins with manual preparation of versioning and changelogs and ends with automated deployment to package registries.
Step-by-Step Release Workflow
The following steps outline the mandatory sequence for a successful release:
- Version Bump: Developers must update the
versionfield in thepackage.jsonfile to reflect the new release. - Changelog Update: All notable changes, categorized by type (Added, Fixed, Security, etc.), must be documented in
CHANGELOG.md. - Git Tagging: A specific git tag (e.g.,
v1.2.3) is created to mark the release point in the version control history. - CI/CD Execution: The automated pipeline triggers a build and runs the full test suite.
- GitHub Release: A GitHub Release is auto-generated, incorporating the relevant section of the changelog.
Sources: CONTRIBUTING.md:131-135, CHANGELOG.md:1-5
Release Flow Diagram
This diagram visualizes the transition from local development to a public automated release.
The flowchart shows the sequential steps from manual file updates to automated publishing.
Sources: CONTRIBUTING.md:129-135
Versioning Standards
The project strictly adheres to Semantic Versioning (SemVer). Version numbers are formatted as MAJOR.MINOR.PATCH.
| Component | Purpose | Frequency |
|---|---|---|
| MAJOR | Incompatible API changes | Rare |
| MINOR | New functionality in a backward compatible manner | Monthly/Feature-driven |
| PATCH | Backward compatible bug fixes or security patches | As needed |
Sources: CHANGELOG.md:5-7, SECURITY.md:5-8
Distribution Channels
Once the release process is triggered and validated, artifacts are distributed through multiple channels to ensure accessibility for different user environments.
Distribution Methods
| Channel | Artifact Type | Deployment Tool |
|---|---|---|
| npm Registry | Node.js Packages | pnpm / GitHub Actions |
| GitHub Releases | Source Code & Binary Tags | GitHub Actions |
| Docker Hub / GHCR | Docker Images | GitHub Actions |
Sources: CONTRIBUTING.md:134, README.md:46-54
Post-Release and Maintenance
Following a release, the project enters a maintenance phase where specific versions are supported according to the security policy.
Supported Versions
The project maintains support for the current major version. Vulnerabilities found in older versions (e.g., < 1.0) are generally directed toward the current stable release.
Sources: SECURITY.md:3-8
Security Update Pipeline
Security-critical fixes follow an accelerated timeline:
- Critical Issues: Fixed within 30 days.
- Other Issues: Fixed within 90 days.
- Announcement: Released as patch versions and announced via GitHub Security Advisories and npm security advisories.
Sources: SECURITY.md:21-29
CI/CD Quality Gates
Before any code is eligible for a release, it must pass through several quality gates defined in the project's orchestration logic. This ensures that the <5% false positive rate and 95% coverage targets are maintained.
The sequence diagram illustrates the automated validation checks that occur after a version tag is pushed.
Sources: CONTRIBUTING.md:57-65, package.json:10-15, README.md:10-13
Build Requirements
The build process converts TypeScript source code into executable JavaScript artifacts.
# Build requirement for packages/cli and packages/core
pnpm install
pnpm build
# Verification of build artifacts
ls -la packages/*/dist
Sources: QUICK_START.md:34-45
Summary
The Release Process for the Unified Security Scanner integrates manual oversight of versioning and changelogs with automated GitHub Actions for testing and deployment. By enforcing Semantic Versioning and strict security response timelines, the project ensures that its multi-phase scanning capabilities—ranging from traditional SAST to AI-enhanced validation—are delivered consistently and securely to the end users.