chore(release): finalize v1.4.0-rc.1 readiness - #41
Conversation
|
🤖 Hi @AcingTime420, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
📝 WalkthroughWalkthroughThe pull request removes CircleCI configuration, strengthens GitHub release packaging, adds a changelog, and replaces release and security documentation with current operational guidance. ChangesRelease and Security Operations
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant GuardianBuild
participant GitHubRelease
GitHubActions->>GuardianBuild: Verify guardian.jar exists
GuardianBuild-->>GitHubActions: Return required artifact
GitHubActions->>GitHubRelease: Publish staged release
GitHubActions->>GitHubRelease: Set prerelease for hyphenated tags
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 97: Update the prerelease expression in the release workflow to evaluate
only the SemVer core by removing any +buildmetadata portion from github.ref_name
before checking for a hyphen. Preserve prerelease detection for versions with a
hyphen in the core while treating versions such as v1.4.0+build-1 as stable.
In `@RELEASE_PROCESS.md`:
- Around line 28-37: Update the release outputs list in RELEASE_PROCESS.md to
include CHANGELOG.md, README.md, SECURITY.md, and RELEASE_PROCESS.md staged in
release/ by .github/workflows/release.yml, or explicitly state that the list is
non-exhaustive.
- Around line 43-48: Add explicit checklist steps before the annotated
release-candidate tag step: confirm the release PR has been merged, then confirm
the post-merge Repository Integrity, Clean-Clone Baseline, Security and
Dependency Review, and SBOM workflows pass. Keep tag creation and pushing after
both gates.
In `@SECURITY.md`:
- Around line 15-20: Update the fallback reporting guidance in SECURITY.md to
provide a repository-controlled private contact method or form instead of
directing reporters to the maintainer’s GitHub profile. Clearly identify that
address or form and instruct reporters to use it without publishing
vulnerability details.
- Around line 26-32: Update SECURITY.md to retain the dependency, audit,
Gitleaks, Dependabot, SBOM, and repository-integrity controls, while labeling
Guardian identity and device-trust foundations as experimental and noting
biometric authentication is a placeholder with attestation using
AcingVaultEmulator. Qualify clean-clone validation as conditional because CI
runs scripts/validate-premerge.sh --skip-compose, and document a private email
or intake channel for cases where GitHub Security Advisories are unavailable.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d46c70c3-f926-4476-b259-8d0419d87436
📒 Files selected for processing (5)
.circleci/config.yml.github/workflows/release.ymlCHANGELOG.mdRELEASE_PROCESS.mdSECURITY.md
💤 Files with no reviewable changes (1)
- .circleci/config.yml
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| generate_release_notes: true | ||
| prerelease: ${{ contains(github.ref_name, '-') }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- release workflow ---'
nl -ba .github/workflows/release.yml | sed -n '1,130p'
printf '%s\n' '--- tag/version references ---'
rg -n -i --glob '!node_modules' --glob '!dist' --glob '!build' \
'semver|pre.?release|buildmetadata|build metadata|github\.ref_name|tag.*v[0-9]|v[0-9].*\+' \
.github README.md docs scripts 2>/dev/null | head -250 || true
printf '%s\n' '--- release-related files ---'
git ls-files | rg '(^|/)(release|Makefile|package\.json|pyproject\.toml|pom\.xml|build\.gradle|Cargo\.toml)' | head -200Repository: AcingTime420/Acing-IU-Genesis
Length of output: 816
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- release workflow ---'
sed -n '1,130p' .github/workflows/release.yml
printf '%s\n' '--- repository tag/version guidance ---'
rg -n -i --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
'semver|pre.?release|build.?metadata|release.*tag|tag.*release|version' \
. ':!/.git' 2>/dev/null | head -300 || true
printf '%s\n' '--- classification probe ---'
python3 - <<'PY'
tags = [
"v1.4.0",
"v1.4.0-rc.1",
"v1.4.0+build-1",
"v1.4.0-rc.1+build-1",
"v1.4.0+build.1",
]
for tag in tags:
version = tag.removeprefix("v")
version_without_build = version.split("+", 1)[0]
current = "-" in tag
proposed = "-" in version_without_build
print(f"{tag}: current={current}, proposed={proposed}")
PYRepository: AcingTime420/Acing-IU-Genesis
Length of output: 39112
Derive prerelease from the SemVer core.
v1.4.0+build-1 matches the workflow trigger but is a stable version. The current expression marks it as a prerelease because the build metadata contains -. Remove the +buildmetadata portion before checking for -, or use a SemVer parser.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 97, Update the prerelease expression
in the release workflow to evaluate only the SemVer core by removing any
+buildmetadata portion from github.ref_name before checking for a hyphen.
Preserve prerelease detection for versions with a hyphen in the core while
treating versions such as v1.4.0+build-1 as stable.
| Every version tag matching `v*.*.*` triggers `.github/workflows/release.yml` and produces: | ||
|
|
||
| --- | ||
| - compiled `guardian.jar`; | ||
| - published Identity and Device Trust .NET services; | ||
| - compiled Next.js frontend files; | ||
| - IRP documentation; | ||
| - SPDX JSON SBOM; | ||
| - SHA-256 checksum; | ||
| - compressed release archive; | ||
| - GitHub Release with generated notes. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the release files staged by the workflow.
.github/workflows/release.yml copies CHANGELOG.md, README.md, SECURITY.md, and RELEASE_PROCESS.md into release/, but this list does not mention those files. Because the section says that every tag “produces” the listed outputs, add the staged documentation or state that the list is non-exhaustive.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~28-~28: The official name of this software platform is spelled with a capital “H”.
Context: ... version tag matching v*.*.* triggers .github/workflows/release.yml and produces: -...
(GITHUB)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@RELEASE_PROCESS.md` around lines 28 - 37, Update the release outputs list in
RELEASE_PROCESS.md to include CHANGELOG.md, README.md, SECURITY.md, and
RELEASE_PROCESS.md staged in release/ by .github/workflows/release.yml, or
explicitly state that the list is non-exhaustive.
| 1. Confirm `master` is current and has no unintended local changes. | ||
| 2. Confirm Repository Integrity, Clean-Clone Baseline, Security and Dependency Review, and SBOM workflows pass. | ||
| 3. Confirm no unresolved release-blocking issues or pull requests remain. | ||
| 4. Update `CHANGELOG.md`. | ||
| 5. Create and push an annotated release-candidate tag. | ||
| 6. Confirm the Release workflow passes. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Add the merge and post-merge gate before tagging.
The PR objective requires the release tag to be created and pushed only after the PR is merged and post-merge checks pass. The checklist moves from validation to tag creation without stating either condition. Add an explicit merge step and require the post-merge Repository Integrity, Clean-Clone Baseline, Security and Dependency Review, and SBOM checks before Line 47.
🧰 Tools
🪛 LanguageTool
[style] ~45-~45: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ncy Review, and SBOM workflows pass. 3. Confirm no unresolved release-blocking issues o...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@RELEASE_PROCESS.md` around lines 43 - 48, Add explicit checklist steps before
the annotated release-candidate tag step: confirm the release PR has been
merged, then confirm the post-merge Repository Integrity, Clean-Clone Baseline,
Security and Dependency Review, and SBOM workflows pass. Keep tag creation and
pushing after both gates.
| Do not open a public issue for a suspected vulnerability. | ||
|
|
||
| 1. Email **security@acing-iu.example** (placeholder — replace with real address before publishing). | ||
| 2. Include: | ||
| - A clear description of the vulnerability. | ||
| - Steps to reproduce or a proof-of-concept (if safe to share). | ||
| - The component(s) affected. | ||
| - The potential impact. | ||
| 3. You will receive an acknowledgement within **72 hours**. | ||
| 4. We target a fix within **14 calendar days** for critical issues and **30 days** for others. | ||
| 5. A CVE will be requested where appropriate. | ||
| 1. Open the repository's **Security** tab. | ||
| 2. Select **Report a vulnerability** to create a private security advisory. | ||
| 3. Include affected components, reproducible steps, impact, and a safe proof of concept when available. | ||
| 4. If private reporting is unavailable, contact the repository maintainer through the GitHub profile without publishing exploit details. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- SECURITY.md ---'
cat -n SECURITY.md
printf '%s\n' '--- repository metadata ---'
git remote -v || true
printf '%s\n' '--- contact and reporting references ---'
rg -n -i 'security|vulnerabil|maintainer|contact|email|private|report' README.md SECURITY.md CODE_OF_CONDUCT.md CONTRIBUTING.md .github 2>/dev/null || trueRepository: AcingTime420/Acing-IU-Genesis
Length of output: 12530
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- public maintainer profile data ---'
curl -fsSL -H 'Accept: application/vnd.github+json' \
https://api.github.com/users/AcingTime420 |
jq '{login,name,email,blog,twitter_username,bio,html_url}'
printf '%s\n' '--- public repository metadata ---'
curl -fsSL -H 'Accept: application/vnd.github+json' \
https://api.github.com/repos/AcingTime420/Acing-IU-Genesis |
jq '{full_name,has_issues,has_discussions,security_and_analysis}'
printf '%s\n' '--- profile page contact links ---'
curl -fsSL https://github.com/AcingTime420 |
grep -Eo 'href="[^"]+"|mailto:[^"]+' |
grep -Ei 'mailto|contact|email|keybase|proton|matrix|pgp|security' || trueRepository: AcingTime420/Acing-IU-Genesis
Length of output: 1040
Make the fallback reporting path private and explicit.
The maintainer profile does not expose or document a private contact method. Add a repository-controlled private address or form for vulnerability reports.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 15 - 20, Update the fallback reporting guidance in
SECURITY.md to provide a repository-controlled private contact method or form
instead of directing reporters to the maintainer’s GitHub profile. Clearly
identify that address or form and instruct reporters to use it without
publishing vulnerability details.
| - pull-request dependency review with a high-severity gate; | ||
| - NuGet transitive vulnerability auditing; | ||
| - npm high/critical vulnerability auditing; | ||
| - full-history Gitleaks secret scanning; | ||
| - weekly Dependabot monitoring for NuGet, npm, Docker, and GitHub Actions; | ||
| - SPDX SBOM generation; | ||
| - repository-integrity and clean-clone validation; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
fail=0
check() {
local label="$1"
local pattern="$2"
if ! rg -n -i -- "$pattern" .github 2>/dev/null; then
printf 'No evidence found for: %s\n' "$label" >&2
fail=1
fi
}
check "npm vulnerability auditing" 'npm[[:space:]]+audit|audit.*(high|critical)'
check "full-history Gitleaks scanning" 'gitleaks|fetch-depth:[[:space:]]*0|--log-opts=.*--all'
check "weekly Dependabot monitoring" 'dependabot|package-ecosystem|interval:[[:space:]]*weekly'
check "SPDX SBOM generation" 'spdx|sbom|syft|anchore'
check "repository-integrity or clean-clone validation" 'repository-integrity|repo-integrity|clean[-_ ]clone|git clone'
exit "$fail"Repository: AcingTime420/Acing-IU-Genesis
Length of output: 2453
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- SECURITY.md ---'
sed -n '1,120p' SECURITY.md
printf '%s\n' '--- security workflow ---'
sed -n '1,180p' .github/workflows/security.yml
printf '%s\n' '--- SBOM workflow ---'
sed -n '1,140p' .github/workflows/sbom.yml
printf '%s\n' '--- CI workflow ---'
sed -n '1,190p' .github/workflows/ci.yml
printf '%s\n' '--- Dependabot configuration ---'
cat .github/dependabot.yml
printf '%s\n' '--- Other workflow triggers and security-related claims ---'
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$f" ] || continue
printf '\n### %s\n' "$f"
rg -n -i '^(name:|on:| [A-Za-z-]+:| - name:| uses:| run:|permissions:| permissions:|fail|audit|gitleaks|sbom|spdx|integrity|clone)' "$f" || true
doneRepository: AcingTime420/Acing-IU-Genesis
Length of output: 23167
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- repository-integrity workflow ---'
sed -n '1,120p' .github/workflows/repo-integrity.yml
printf '%s\n' '--- threat-model references ---'
rg -n -i -C 3 'guardian|device.?trust|fail.?closed|clean.?clone|integrity|planned|stub|experimental' THREAT_MODEL.md .github scripts backend frontend 2>/dev/null | head -n 320
printf '%s\n' '--- Guardian and device-trust declarations ---'
rg -n -i 'Guardian|DeviceTrust|Device.?Trust|fail.?closed|fail.?open|deny|allow' backend frontend --glob '!**/bin/**' --glob '!**/obj/**' 2>/dev/null | head -n 320
printf '%s\n' '--- clean-clone and repository-integrity declarations ---'
rg -n -i -C 2 'clean.?clone|repo.?integrity|generated artifacts|tracked generated|git ls-files|validate-premerge' .github scripts README.md SECURITY.md THREAT_MODEL.md 2>/dev/null | head -n 320Repository: AcingTime420/Acing-IU-Genesis
Length of output: 46137
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- Guardian source files ---'
git ls-files 'system/security/guardian' | head -n 80
printf '%s\n' '--- Guardian source outline ---'
for f in $(git ls-files 'system/security/guardian' | head -n 12); do
printf '\n### %s\n' "$f"
wc -l "$f"
rg -n -i 'auth|identity|device|trust|fail|deny|allow|stub|TODO|planned|experimental|emulat' "$f" | head -n 80 || true
done
printf '%s\n' '--- focused policy evidence check ---'
python3 - <<'PY'
from pathlib import Path
import re
security = Path("SECURITY.md").read_text()
security_workflow = Path(".github/workflows/security.yml").read_text()
sbom_workflow = Path(".github/workflows/sbom.yml").read_text()
ci_workflow = Path(".github/workflows/ci.yml").read_text()
integrity_workflow = Path(".github/workflows/repo-integrity.yml").read_text()
dependabot = Path(".github/dependabot.yml").read_text()
threat_model = Path("THREAT_MODEL.md").read_text()
validator = Path("scripts/validate-premerge.sh").read_text()
checks = {
"private advisory reporting": "Report a vulnerability" in security,
"fallback names only a GitHub profile": "contact the repository maintainer through the GitHub profile" in security,
"dependency review high gate": "fail-on-severity: high" in security_workflow,
"NuGet transitive audit": "--vulnerable --include-transitive" in security_workflow,
"npm high audit": "npm audit --audit-level=high" in security_workflow,
"full-history checkout for Gitleaks": "fetch-depth: 0" in security_workflow and "gitleaks/gitleaks-action" in security_workflow,
"weekly Dependabot ecosystems": all(
ecosystem in dependabot and "interval: weekly" in dependabot
for ecosystem in ("nuget", "npm", "github-actions", "docker")
),
"SPDX SBOM generation": "format: spdx-json" in sbom_workflow,
"repository-integrity failure path": "exit 1" in integrity_workflow and "git ls-files" in integrity_workflow,
"clean-clone validator invoked": "bash scripts/validate-premerge.sh --skip-compose" in ci_workflow,
"clean-clone validator skips unavailable checks": "skipping" in validator.lower(),
"threat model marks auth stub": "iu_auth_service` is a shell stub" in threat_model,
"threat model marks hardware trust planned": "Replace emulator with TrustZone" in threat_model and "📋 Planned" in threat_model,
}
for label, result in checks.items():
print(f"{'PASS' if result else 'FAIL'}: {label}")
PYRepository: AcingTime420/Acing-IU-Genesis
Length of output: 12321
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- GuardianService decision paths ---'
sed -n '60,245p' system/security/guardian/core/GuardianService.kt
printf '%s\n' '--- IdentityService authentication paths ---'
sed -n '100,195p' system/security/guardian/identity/IdentityService.kt
printf '%s\n' '--- DeviceTrustEngine decision paths ---'
sed -n '1,220p' system/security/guardian/trust/DeviceTrustEngine.kt
printf '%s\n' '--- Guardian policy definitions ---'
cat system/security/guardian/policy/policies.json
printf '%s\n' '--- Threat-model status table ---'
sed -n '24,105p' THREAT_MODEL.mdRepository: AcingTime420/Acing-IU-Genesis
Length of output: 20602
Qualify Guardian and clean-clone controls, and add a private fallback channel.
- Keep the dependency, audit, Gitleaks, Dependabot, SBOM, and repository-integrity controls as implemented.
- Label Guardian identity and device-trust foundations as experimental. Biometric authentication is a placeholder, and attestation uses
AcingVaultEmulator. - Qualify clean-clone validation as conditional because CI runs
scripts/validate-premerge.sh --skip-composeand skips unavailable checks. - Add a private email address or intake channel when GitHub Security Advisories are unavailable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 26 - 32, Update SECURITY.md to retain the
dependency, audit, Gitleaks, Dependabot, SBOM, and repository-integrity
controls, while labeling Guardian identity and device-trust foundations as
experimental and noting biometric authentication is a placeholder with
attestation using AcingVaultEmulator. Qualify clean-clone validation as
conditional because CI runs scripts/validate-premerge.sh --skip-compose, and
document a private email or intake channel for cases where GitHub Security
Advisories are unavailable.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 98f422518c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 2. Apply minimal fix. | ||
| 3. Fast-track CI + security review. | ||
| 4. Tag as `vX.Y.Z+1` and backport to `main`. | ||
| 1. Confirm `master` is current and has no unintended local changes. |
There was a problem hiding this comment.
The repository's active branch is main, not master (and existing contributor guidance and multiple workflows also target main). An operator following this checklist cannot prepare the release from the named branch, while the hotfix section likewise directs corrections back to a nonexistent branch; change these new master references, including the supported-version entry in SECURITY.md, back to main.
Useful? React with 👍 / 👎.
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| generate_release_notes: true | ||
| prerelease: ${{ contains(github.ref_name, '-') }} |
There was a problem hiding this comment.
This marks any tag containing a hyphen as a prerelease, including stable SemVer tags whose build metadata contains one, such as v1.4.0+linux-x64. Since the documented version format permits build metadata, such a stable release would be incorrectly published as a GitHub prerelease; determine whether a hyphen occurs in the version portion before any + metadata instead.
Useful? React with 👍 / 👎.
| cp README.md SECURITY.md RELEASE_PROCESS.md release/ | ||
| if [[ -f out/guardian.jar ]]; then cp out/guardian.jar release/; fi | ||
| cp README.md SECURITY.md RELEASE_PROCESS.md CHANGELOG.md release/ | ||
| cp system/security/guardian/build/out/guardian.jar release/guardian.jar |
There was a problem hiding this comment.
The Guardian build target produces guardian_init.sh, iu_security_init, iu_auth_service, and the vault scripts alongside the JAR, and the repository's top-level build packages all of them because the boot sequence invokes these executables. Copying only guardian.jar leaves the release archive without the boot/runtime components needed to exercise the Guardian platform during the required artifact smoke test.
Useful? React with 👍 / 👎.
| 1. Confirm `master` is current and has no unintended local changes. | ||
| 2. Confirm Repository Integrity, Clean-Clone Baseline, Security and Dependency Review, and SBOM workflows pass. | ||
| 3. Confirm no unresolved release-blocking issues or pull requests remain. | ||
| 4. Update `CHANGELOG.md`. |
There was a problem hiding this comment.
The rewritten checklist removes the previous build-version bump, while the workflow does not derive a version from the tag: the frontend package remains 1.0.0, and both .NET projects have no version property and therefore publish with their default 1.0 version. Following this checklist for v1.4.0-rc.1 consequently creates artifacts whose embedded metadata identifies a different release, so update the build metadata or inject the tag version before publishing.
Useful? React with 👍 / 👎.
| - weekly Dependabot monitoring for NuGet, npm, Docker, and GitHub Actions; | ||
| - SPDX SBOM generation; | ||
| - repository-integrity and clean-clone validation; | ||
| - fail-closed Guardian identity and device-trust foundations. |
There was a problem hiding this comment.
On a normal Guardian startup, initializeIdentityLayer merely provisions and immediately revokes a probe credential before setting authAvailable, while requireBiometricOrStrongAuth returns true without authenticating a caller; the boot-facing iu_auth_service also remains a stub that exits successfully. Listing this as implemented fail-closed identity enforcement hides the scenario where the admin setup proceeds without any real authentication, so retain the explicit stub limitation and classify this control as experimental until an actual credential check is wired into the access path.
Useful? React with 👍 / 👎.
1 participant
Summary
Closes the final release-readiness gaps found during the cross-plugin preflight review.
Corrections
Validation required
Release rule
Do not create or push
v1.4.0-rc.1until this PR is merged and post-merge checks pass.Summary by CodeRabbit
Release Improvements
Documentation
Chores