Reference: org governance & release runbooks
Reference: org governance & release runbooks
Section titled “Reference: org governance & release runbooks”This repository follows the shared governance, CI, and release process of the
modeled-information-format organization. Those
processes are maintained once, centrally, in the org
.github repository and apply to every
repo that adopts the attested-delivery backbone — including this one. The runbooks below are the
authoritative, governing process; this page makes them reachable from here.
Runbooks
Section titled “Runbooks”| Runbook | What it governs |
|---|---|
| Release runbook | The required, audit-gated attested release process: punch-list audit, epics + sub-issues, a decision log, a release workplan issue, one PR per epic under GitHub Flow, and the attested cutover. |
| Branch-protection runbook | The required-checks, single-review, and linear-history rules applied to protected branches. |
| Dependabot auto-merge runbook | The policy and rollout for auto-merging patch Dependabot updates via the org CI app — minor/major and non-semver bumps stay manual for review. |
| Labels runbook | The org-wide label taxonomy and the reusable label-sync that keeps every repo consistent. |
Reusable CI/release workflows
Section titled “Reusable CI/release workflows”This repo’s CI and release gates are thin SHA-pinned callers of the org’s reusable workflows
in .github/.github/workflows/
— SAST (CodeQL/Semgrep), SCA (OSV-Scanner), Trivy, Checkov, Scorecard, secrets, VEX, actionlint,
shellcheck, sign-and-attest, and verify-gates. The architecture is recorded in the org
ADR-002: reusable quality-gate architecture.