chore(release): merge paused v0.1.0 work back to dev

.github/workflows/release-build.yml

@@ -41,7 +41,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-go@b7ad1dad31e06c5925f5d2fc7ad053ef454303e # v7.0.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/release-candidate.yml

@@ -72,6 +72,11 @@ jobs:
     permissions:
       contents: write
     steps:
+      - name: Check out release source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.build.outputs.source_sha }}
+
       - name: Download release assets
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -86,9 +91,10 @@ jobs:
           ASSET_DIR: ${{ github.workspace }}/dist/github-release
         run: |
           set -euo pipefail
+          deployments/packages/render-github-release-notes.sh "$VERSION" "$GITHUB_REPOSITORY" rc >"$RUNNER_TEMP/release-notes.md"
           gh release create "$VERSION" "$ASSET_DIR"/* \
             --repo "$GITHUB_REPOSITORY" \
             --target "$SOURCE_SHA" \
             --title "SysArmor $VERSION" \
-            --generate-notes \
+            --notes-file "$RUNNER_TEMP/release-notes.md" \
             --prerelease

.github/workflows/release-stable.yml

@@ -92,6 +92,11 @@ jobs:
     permissions:
       contents: write
     steps:
+      - name: Check out release source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.build.outputs.source_sha }}
+
       - name: Download release assets
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -106,8 +111,9 @@ jobs:
           ASSET_DIR: ${{ github.workspace }}/dist/github-release
         run: |
           set -euo pipefail
+          deployments/packages/render-github-release-notes.sh "$VERSION" "$GITHUB_REPOSITORY" ga >"$RUNNER_TEMP/release-notes.md"
           gh release create "$VERSION" "$ASSET_DIR"/* \
             --repo "$GITHUB_REPOSITORY" \
             --target "$SOURCE_SHA" \
             --title "SysArmor $VERSION" \
-            --generate-notes
+            --notes-file "$RUNNER_TEMP/release-notes.md"

CONTRIBUTING.md

@@ -0,0 +1,31 @@
+# Contributing To SysArmor
+
+SysArmor welcomes focused bug reports and pull requests. Before starting a larger change, open an issue
+to confirm the problem, intended outcome, and ownership boundary. Report security vulnerabilities through
+the private process in [SECURITY.md](SECURITY.md), not through a public issue.
+
+## Development Workflow
+
+Create feature and fix branches from `dev`, then open pull requests back to `dev`. Release branches are
+short-lived and are merged into `main` only after release-candidate acceptance. Do not commit directly to
+`dev` or `main`.
+
+Keep changes narrow and follow the surrounding code style. Use Conventional Commits such as `feat:`,
+`fix:`, `docs:`, and `test:`; keep each commit focused on one concern. The
+[development guide](docs/development/development.md) describes repository boundaries, build commands, and
+contracts that must stay synchronized.
+
+## Verification
+
+Add or update tests for behavior changes and run the smallest suite that fully covers the change. Shared
+contracts and user-facing workflows require broader regression coverage. See the
+[testing guide](docs/development/testing.md) for Product, Effectiveness, and Performance suites.
+
+At minimum, run:
+
+```bash
+make test-unit
+git diff --check
+```
+
+Document any relevant test that cannot be run and explain the remaining risk in the pull request.

README.md

@@ -50,10 +50,11 @@ sudo sysarmorctl event watch --include-recent
 sudo sysarmorctl signal watch --include-recent
 ```
 
-You can also select a development pre-release on GitHub Releases and run the exact install command shown
-on that release. Public pre-releases install in standalone mode by default and expose a `linux-container`
-profile for image builds. See [Deployment](docs/operations/deployment.md)
-for verification, platform limits, and offline distribution constraints.
+You can also select a release on GitHub Releases and run the exact install command shown on that release.
+Release candidates are marked as pre-releases and become stable releases after acceptance. Public packages
+install in standalone mode by default and expose a `linux-container` profile for image builds. See
+[Deployment](docs/operations/deployment.md) for verification, platform limits, and offline distribution
+constraints.
 
 See [Quickstart](docs/quickstart.md) for prerequisites, verification, and next steps.
 

README.zh-CN.md

@@ -50,8 +50,9 @@ sudo sysarmorctl event watch --include-recent
 sudo sysarmorctl signal watch --include-recent
 ```
 
-也可以从 GitHub Releases 选择一个开发预发布版本，执行其页面提供的一键安装命令。公开预发布包
-默认安装为 standalone；详细的校验、平台限制和离线分发边界见[部署指南](docs/operations/deployment.md)。
+也可以从 GitHub Releases 选择目标版本，执行其页面提供的一键安装命令。候选版本标记为
+Pre-release，验收通过的版本发布为正式版本；公开发行包默认安装为 standalone。详细的校验、
+平台限制和离线分发边界见[部署指南](docs/operations/deployment.md)。
 
 完整前置条件、验证步骤和下一步见[快速开始](docs/quickstart.md)。
 

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+SysArmor is preparing its first stable release. Security fixes currently target the latest `0.1.x`
+release candidate and, once published, the latest stable `0.1.x` release. Older development builds and
+release candidates are not maintained after a replacement is available.
+
+## Reporting A Vulnerability
+
+Please do not disclose suspected vulnerabilities in a public issue. Use GitHub's
+[Report a vulnerability](https://github.com/PKU-ASAL/sysarmor/security/advisories/new) form so the report
+and follow-up discussion remain private.
+
+Include the affected version, deployment profile, reproduction steps, expected impact, and any known
+mitigation. Maintainers will acknowledge the report through the advisory and coordinate validation,
+remediation, and disclosure there.

deployments/packages/render-github-release-notes.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: render-github-release-notes.sh VERSION OWNER/REPOSITORY rc|ga" >&2
+}
+
+if [[ $# -ne 3 ]]; then
+  usage
+  exit 2
+fi
+
+version="$1"
+repository="$2"
+release_type="$3"
+source_sha="${SOURCE_SHA:-${GITHUB_SHA:-unknown}}"
+
+[[ "$repository" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || {
+  echo "[release-notes][ERROR] invalid repository: $repository" >&2
+  exit 2
+}
+
+case "$release_type" in
+  rc)
+    [[ "$version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[1-9][0-9]*$ ]] || {
+      echo "[release-notes][ERROR] invalid RC version: $version" >&2
+      exit 2
+    }
+    release_label="release candidate"
+    ;;
+  ga)
+    [[ "$version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
+      echo "[release-notes][ERROR] invalid GA version: $version" >&2
+      exit 2
+    }
+    release_label="release"
+    ;;
+  *)
+    echo "[release-notes][ERROR] release type must be rc or ga" >&2
+    exit 2
+    ;;
+esac
+
+cat <<EOF
+SysArmor \`$version\` $release_label from commit \`$source_sha\`.
+
+## Online installation
+
+\`\`\`bash
+curl -fsSL https://github.com/$repository/releases/download/$version/install.sh | sudo bash
+\`\`\`
+
+## Container image installation
+
+\`\`\`dockerfile
+RUN apt-get update && apt-get install -y --no-install-recommends bash ca-certificates curl util-linux
+RUN curl -fsSL https://github.com/$repository/releases/download/$version/install.sh \\
+    | bash -s -- --profile linux-container
+ENTRYPOINT ["/usr/local/bin/sysarmor-container-entrypoint"]
+\`\`\`
+
+Run the container with privileged mode, the host cgroup namespace, host BTF and bpffs mounts, and a restart policy:
+
+\`\`\`bash
+docker run -d --privileged --cgroupns=host --restart unless-stopped \\
+  -v /sys/kernel/btf/vmlinux:/sys/kernel/btf/vmlinux:ro \\
+  -v /sys/fs/bpf:/sys/fs/bpf <image>
+\`\`\`
+
+## Verify build provenance
+
+\`\`\`bash
+gh attestation verify sysarmor-agent-linux-amd64-$version.tar.gz --repo $repository
+\`\`\`
+
+## What's changed
+
+[View commits for $version](https://github.com/$repository/commits/$version)
+EOF

docs/development/development.md

@@ -65,16 +65,21 @@ make web-build
 ### GitHub 发布
 
 发布使用短生命周期 `release/vX.Y.Z` 分支。先将功能分支通过 PR 合入 `dev`，再从冻结的
-`dev` 创建 release 分支；不要直接提交到 `dev` 或 `main`。
+`dev` 创建 release 分支；不要直接提交到 `dev` 或 `main`。首次引入或修改发布入口时，
+对应 workflow 必须先存在于默认分支，否则 GitHub 不提供 `workflow_dispatch` 入口。
 
 从 `release/vX.Y.Z` 手动触发 `.github/workflows/release-candidate.yml`，输入正整数
 `rc_number`，创建 `vX.Y.Z-rc.N` Pre-release。RC 使用 runner 临时生成的 RSA manifest key
-和 Ed25519 content key。RC 发布后，必须使用公开 GitHub Release URL 完成 fresh medium 和
-Ubuntu 22.04、Ubuntu 24.04、Debian 12 三镜像验收，再冻结 release 分支。
+和 Ed25519 content key。工作流从同一提交生成安装说明、容器示例、provenance 验证命令和
+变更链接，并通过 `--notes-file` 创建 Release，不使用只生成变更列表的默认说明。RC 发布后，
+必须使用公开 GitHub Release URL 完成 fresh medium 和 Ubuntu 22.04、Ubuntu 24.04、
+Debian 12 三镜像验收，再冻结 release 分支。
 
 验收通过后，将 release 分支通过 PR 合入 `main`。从 `main` 手动触发
 `.github/workflows/release-stable.yml`，输入不带 `v` 的 `version` 和已验收的
-`accepted_rc_tag`。工作流仅在 `main` 与 RC tag 的 Git tree 完全一致时继续。
+`accepted_rc_tag`。工作流仅在 `main` 与 RC tag 的 Git tree 完全一致时继续，并使用同一
+Release notes 渲染器生成正式版本说明。GitHub Releases 是发行变更记录的事实来源，不另行
+维护重复的 changelog。
 
 正式发布前，仓库必须配置受保护的 `production-release` Environment、审批人，以及：
 

docs/operations/deployment.md

@@ -7,7 +7,7 @@
 | 目标 | 入口 | 适用场景 |
 |---|---|---|
 | 单机 Agent | `make install-agent` | 无平台连接的主机采集、检测和本地调查 |
-| GitHub 开发预发布 | Release 页面中的 `install.sh` | 从 `dev` 构建的可追溯 standalone 体验版本 |
+| GitHub 发行包 | Release 页面中的 `install.sh` | 可追溯的 standalone 候选版本或正式版本 |
 | 本地管理平台 | `make deploy` | 端云链路、集中管理和开发验证 |
 
 当前 Compose 配置面向单机开发和验证，默认凭据、无安全插件的 OpenSearch 以及宿主机暴露的基础设施端口不应直接用于生产环境。
@@ -46,18 +46,19 @@ sudo sysarmorctl agent health
 
 默认配置运行 managed Tetragon、host scope 和 observe-only 模式，不连接平台。注册信息由 enrollment 写入本地状态，不应手工添加到 YAML。自定义安装路径和配置项见[配置参考](../reference/configuration.md)。
 
-### 安装 GitHub 开发预发布
+### 安装 GitHub 发行包
 
-在 GitHub Releases 页面选择标记为 Pre-release 的版本，使用该版本说明中的固定 URL：
+在 GitHub Releases 页面选择目标版本，使用该版本说明中的固定 URL。候选版本标记为
+Pre-release；正式版本不带该标记：
 
 ```bash
-curl -fsSL https://github.com/PKU-ASAL/sysarmor/releases/download/<version>/install.sh | sudo bash
+curl -fsSL https://github.com/PKU-ASAL/sysarmor/releases/download/<tag>/install.sh | sudo bash
 ```
 
-开发预发布支持 Linux x86_64；默认 `linux-systemd` profile 安装主机服务，
-`linux-container` profile 用于容器镜像。版本号同时包含构建时间与 Git commit，例如
-`v0.1.0-dev.20260724+097acdae`。安装脚本下载同一 Release 的归档，校验固定 SHA-256，
-安装后等待 Agent 健康检查通过。重复安装会更新程序和 systemd unit，但保留已有配置、策略和本地数据。
+公开发行包支持 Linux x86_64；默认 `linux-systemd` profile 安装主机服务，
+`linux-container` profile 用于容器镜像。RC tag 采用 `vX.Y.Z-rc.N`，正式版本采用
+`vX.Y.Z`。安装脚本下载同一 Release 的归档，校验固定 SHA-256，安装后等待 Agent 健康检查
+通过。重复安装会更新程序和 systemd unit，但保留已有配置、策略和本地数据。
 
 GitHub 公开归档只包含 SysArmor。安装时从 Tetragon 官方 Release 下载锁定版本并校验固定
 SHA-256，从而避免在第三方许可证清单完成前重新分发其二进制。需要完全离线的一体包时，仍须先完成
@@ -66,7 +67,7 @@ SHA-256，从而避免在第三方许可证清单完成前重新分发其二进
 可使用 GitHub CLI 验证构建来源：
 
 ```bash
-gh attestation verify sysarmor-agent-linux-amd64-<version>.tar.gz --repo PKU-ASAL/sysarmor
+gh attestation verify sysarmor-agent-linux-amd64-<tag>.tar.gz --repo PKU-ASAL/sysarmor
 ```
 
 ### 安装到容器镜像
@@ -168,7 +169,7 @@ make release RELEASE_VERSION=v1.0.0
 
 产物写入 `dist/release/`。Package 服务提供不可变字节，Manager 管理 artifact 元数据、channel、一次性 enrollment 和安装脚本。
 
-本地平台 Agent bundle 还包含 Tetragon、bpftool、gops 和 BPF 对象等第三方资产。仓库根目录的 MulanPSL-2.0 只覆盖 SysArmor，不改变第三方组件的许可证。在完成逐项许可证清单、LICENSE/NOTICE 携带和全部打包文件完整性校验前，该一体 bundle 只用于开发与评估，不能作为已经完成外部分发合规的制品发布。GitHub 开发预发布使用不携带 Tetragon 二进制的 thin 包，不属于该一体 bundle。
+本地平台 Agent bundle 还包含 Tetragon、bpftool、gops 和 BPF 对象等第三方资产。仓库根目录的 MulanPSL-2.0 只覆盖 SysArmor，不改变第三方组件的许可证。在完成逐项许可证清单、LICENSE/NOTICE 携带和全部打包文件完整性校验前，该一体 bundle 只用于开发与评估，不能作为已经完成外部分发合规的制品发布。GitHub 发行包使用不携带 Tetragon 二进制的 thin 包，不属于该一体 bundle。
 
 推荐从 Manager Console 的 Deploy 页面选择 artifact、channel 和安装 profile，然后在目标端执行生成的安装命令。完整流程为：