StringKe · StringKe · Aug 12, 2026 · Aug 12, 2026
@@ -0,0 +1,71 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: GitHub Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # actions/checkout v6.0.1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        with:
+          fetch-depth: 0
+
+      - name: Validate annotated SemVer tag
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Unsupported release tag: $GITHUB_REF_NAME" >&2
+            exit 1
+          fi
+          test "$(git cat-file -t "refs/tags/$GITHUB_REF_NAME")" = "tag"
+          package_version="$(node -p \
+            "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
+          test "$GITHUB_REF_NAME" = "v$package_version"
+          grep -F "## [$package_version]" CHANGELOG.md
+
+      # orhun/git-cliff-action v4.8.0, running git-cliff v2.13.1
+      - name: Generate release notes
+        id: git-cliff
+        uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5
+        with:
+          version: v2.13.1
+          config: cliff.toml
+          args: --current --strip all --verbose
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+        env:
+          OUTPUT: RELEASE_NOTES.md
+          GITHUB_REPO: ${{ github.repository }}
+
+      - name: Validate release notes
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -s RELEASE_NOTES.md
+          grep -F "## [${GITHUB_REF_NAME#v}]" RELEASE_NOTES.md
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            echo "GitHub Release $GITHUB_REF_NAME already exists"
+            exit 0
+          fi
+          # No build, package publication, container, or custom release asset is produced here.
+          gh release create "$GITHUB_REF_NAME" \
+            --verify-tag \
+            --title "$GITHUB_REF_NAME" \
+            --notes-file RELEASE_NOTES.md \
+            --latest
@@ -3,5 +3,6 @@
 # 不用 prettier/eslint:代码质量走 vite-plus 内置 oxlint(lint)+ oxfmt(format),见根 vite.config.ts。
 
 [tools]
+git-cliff = "2.13.1"
 node = "24.15.0"
 pnpm = "10.33.4"
@@ -5,100 +5,91 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/), and this
 project adheres to [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html).
 
-## Versioning
+This file is generated by [git-cliff](https://github.com/orhun/git-cliff) from Conventional Commits.
+Run `pnpm changelog --tag vX.Y.Z` to prepare a release; do not edit it by hand.
 
-| Situation | Identifier |
-| --------- | ---------- |
-| Pre-release development on `main` | Git **commit SHA** (unique per revision). Root `package.json` remains `0.0.0` until the first tagged release. |
-| Published release | Annotated git tag `vMAJOR.MINOR.PATCH` (SemVer), matching a GitHub Release and a CHANGELOG section. |
-| Public API stability | Unstable until 1.0.0; breaking changes may land without a long deprecation window while pre-1.0. |
-
-When a release is cut: add a dated `## [X.Y.Z] - YYYY-MM-DD` section, move items out of
-`[Unreleased]`, and tag the repository. Every published release is identified in version control by
-that tag.
-
-### Security entries
-
-Every **publicly known** vulnerability fixed in a release **must** be listed under a `### Security`
-heading in that release’s notes (CVE or advisory URL when available). If a release has no security
-fixes, omit the heading. Private reports that never became public need not be listed until
-disclosure.
-
-OpenSSF Best Practices self-certification notes: [`docs/openssf-best-practices.md`](docs/openssf-best-practices.md).
-
-## [Unreleased]
+## [0.0.1] - 2026-08-12
 
 ### Security
-
-- No publicly disclosed vulnerability fixes in this period.
-- Documented OpenSSF-aligned fix timelines (60-day public medium+ fixes, critical prioritization),
-  cryptography defaults, and static/dynamic analysis practices in `SECURITY.md`.
-
-### Changed
-
-- **License changed from Elastic License 2.0 to the MIT License.** XID is now open source under an
-  OSI-approved license. The Elastic License restrictions (no hosted service offering, no license key
-  circumvention, no removal of license notices) no longer apply. The only remaining obligation is to
-  retain the copyright and permission notice.
-- Clarified versioning (commit SHA until first SemVer tag) and Security release-note rules in
-  `CHANGELOG.md`.
-- Homepage footer and README community tables now link Support, Security, and Contributing for
-  feedback and contribution discovery.
-- Project status copy no longer claims zero production evidence. It states pre-1.0 API instability,
-  live first-party L4 on `https://xid.dev`, and that external IdP/SaaS/social/SMS paths stay
-  non-production-supported until their L4 rows exist (`README*`, `SECURITY.md`, `SUPPORT.md`, site
-  home evidence blurb).
+- **python:** Bump cryptography to 50.x for PKCS#7 oracle fix ([ac58bbb](https://github.com/StringKe/xid/commit/ac58bbb2b002f444f5437808a6586504d8c07750))
+- **deps:** Batch security and dependency upgrades ([0cc782c](https://github.com/StringKe/xid/commit/0cc782c062716e440d1424b74a15395a3d6edec3))
+- **deps:** Resolve all dependabot and audit security alerts ([9b2543f](https://github.com/StringKe/xid/commit/9b2543f29d21645e6911990fc7d94c35b7addf28))
+- **deps:** 修复 brace-expansion 高危依赖 ([7ccfaaa](https://github.com/StringKe/xid/commit/7ccfaaa5b9ac918c10b30654f5ef5d12b28e00bc))
+- **security:** 移除 RSA 漏洞依赖并修复 smoke ([0c68ee2](https://github.com/StringKe/xid/commit/0c68ee2d036821995e234c1bc970874a381eb2e1))
+- **security:** Address remote security checks ([06902db](https://github.com/StringKe/xid/commit/06902dbd9560a709d86225f0a61532838316d604))
+- **security:** Remediate repository security alerts ([31e1d1a](https://github.com/StringKe/xid/commit/31e1d1afbc76cc7c1e7b282a67a2ba88d468f899))
 
 ### Added
+- **site:** Launch localized product landing ([1faa63f](https://github.com/StringKe/xid/commit/1faa63f0e3c8eb5fffcc0c2daa8736534662d7a4))
+- **server:** Manage access requests and policy via v1 ([43f508f](https://github.com/StringKe/xid/commit/43f508f60bf6d23bea8c4f6972ae230429170e58))
+- **server:** Access request self-service and approval APIs ([a9c1ac1](https://github.com/StringKe/xid/commit/a9c1ac176c54cfb7270115c0612807a666f9e64f))
+- **server:** Enforce access policy in authorize ([8e2828d](https://github.com/StringKe/xid/commit/8e2828d9648c0dfbc17b0daf841a12ac90fcb4da))
+- **db:** Project access policy and access requests schema ([1e1b022](https://github.com/StringKe/xid/commit/1e1b022fadb44a4a1abf748c40eb7e1045147760))
+- **server:** Org units management API ([e73db5f](https://github.com/StringKe/xid/commit/e73db5f8fd1b8c7457c844545eeebcb58bdf990f))
+- **db:** Org unit tree service and queries ([8a0d761](https://github.com/StringKe/xid/commit/8a0d7615fb1550697a2f8923155d3ec0f10a4f17))
+- **db:** Add org_units and org_unit_members schema ([f00e5e4](https://github.com/StringKe/xid/commit/f00e5e4d55a94762f6ab189ac088c29cafb99c0a))
+- **react:** Add useUpgradeGuest hook ([d0e8173](https://github.com/StringKe/xid/commit/d0e8173a78175f3d8b8da28d828d7625b5c5ba1c))
+- **core:** Add guest passkey upgrade and silent re-authentication ([44a2619](https://github.com/StringKe/xid/commit/44a2619d86980070f39da1bc09241f86d3111f67))
+- **console:** Rebuild console and hosted auth flows on the shared design system ([ce94366](https://github.com/StringKe/xid/commit/ce9436601e771e17d0863a89e22e297002c8947a))
+- **platform:** Complete XID production readiness ([ffca608](https://github.com/StringKe/xid/commit/ffca60834c355ebb5e82d8da295b620f8c182dc9))
+- **auth:** Unify tenant onboarding and email verification ([81bdf03](https://github.com/StringKe/xid/commit/81bdf030ccd06fe23ec7600020664ca2a9f3e62d))
+- **web:** 统一 Nimbus 产品首页与 Workers Builds ([f41856f](https://github.com/StringKe/xid/commit/f41856f39a3ae96bb620adfdfb660addf8f2a34b))
+- Firebase 式访客模式(匿名登录与原地转正) (#25) ([995f65c](https://github.com/StringKe/xid/commit/995f65c6aae0bdc77e8a0fdbf0222f51143ce2d2))
+- Initial public release ([7c80167](https://github.com/StringKe/xid/commit/7c801679ee46862c450de34bf10dcb0169ba558a))
+
+### Fixed
+- **ci:** Format after comment purge and refresh translation markers ([760eb5a](https://github.com/StringKe/xid/commit/760eb5ab498a04424dff0ba8e67ff7fe7759b130))
+- **ci:** Align smoke with site landing routes ([a23a31a](https://github.com/StringKe/xid/commit/a23a31a40554d9ca836d199aead4aaea49a765f1))
+- **hosted-auth:** Restyle the guest conversion banner as a shell band ([bc1c5fe](https://github.com/StringKe/xid/commit/bc1c5fef497fd60294f0379554818b999c82e535))
+- **console:** Align entry states with the control-plane layout grammar ([a50e263](https://github.com/StringKe/xid/commit/a50e2639bb880d0efe7c82e0e9e94c8045d82c8b))
+- **hosted-auth:** Remove the serial wait before the guest entry appears ([94d4d2f](https://github.com/StringKe/xid/commit/94d4d2f97beaa12f9ad07938272375fac7caa687))
+- **tests:** Follow console trailing-slash redirect in wildcard route probe ([063f237](https://github.com/StringKe/xid/commit/063f23764cc1b06de8a3f0226aa53c0191210625))
+- **build:** Bootstrap workspace deps in app build scripts for Workers Builds ([0cb5bb7](https://github.com/StringKe/xid/commit/0cb5bb7880ce158a39fa7e805d8669a5499375e4))
+- **build:** Build workspace deps before check and test tasks ([ec805a5](https://github.com/StringKe/xid/commit/ec805a5d3d3c68f4ce2ea3ef31f731fe4515193b))
+- **ci:** 为浏览器 smoke 配置 Linux Chrome ([d34ae2b](https://github.com/StringKe/xid/commit/d34ae2b2ab36fabb218939e92497bbfd27ff084d))
+- **web:** 修复远端构建与安全检查 ([32ac45c](https://github.com/StringKe/xid/commit/32ac45c9631f669e825974dfee560d26596bbba3))
 
-- OpenSSF Best Practices Passing self-certification pack:
-  [`docs/openssf-best-practices.md`](docs/openssf-best-practices.md) with paste-ready Met/N/A
-  justifications for project 13783.
-- Explicit Testing policy and warnings/static-analysis section in `CONTRIBUTING.md`.
-
-- Enterprise org structure (OrgUnit): an in-org business tree with adjacency plus materialized path
-  (depth cap 8), primary/secondary post placement, reporting-line manager resolution walking up the
-  ancestor chain, and nine Management API endpoints under `/v1/organizations/:orgId/units` (tree
-  CRUD, move, archive, members), guarded by the new `org-units` API key scope or an org manager
-  cookie session. OrgUnit carries no tenant-boundary semantics and never enters token claims.
-- Project access requests with approval: per-project `access_policy` (`open`/`restricted`/
-  `approval_required`) gating the same-org `/authorize` and token-issuance paths, self-service
-  `/auth/access-requests` and approver `/auth/access-approvals` session endpoints, approver
-  resolution (OrgUnit reporting line -> `project_manager` -> `org_manager`, self-approval skipped),
-  approval writing a `user_grants` row with `granted_via_request_id` and an optional `expires_at`
-  JIT window, read-only `/v1` access-request listing with the new `access-requests` scope, and the
-  audit events `access_request.created/approved/denied/cancelled/expired` plus
-  `project.access_policy_changed`.
-- Guest one-click passkey upgrade in the SDKs: `@xid-kit/core` `upgradeGuestWithPasskey()` and
-  `@xid-kit/react` `useUpgradeGuest()` convert an anonymous (guest) session in place -- the passkey
-  ceremony attaches to the existing user and `sub` is preserved. Same-origin mode only; non-guest
-  callers and authenticator cancellation map to expected-failure Results.
-- Silent re-authentication for OIDC browser applications: `@xid-kit/core` `signInSilent()` runs a
-  best-effort hidden-iframe `prompt=none` attempt and `signInSilentWithRedirect()` is the reliable
-  top-level redirect fallback. Silent authorization errors (`login_required`, `consent_required`,
-  `interaction_required`) map to expected-failure Results instead of throwing.
-- Open source governance files: `CONTRIBUTING.md` (with DCO 1.1 sign-off), `CODE_OF_CONDUCT.md`
-  (Contributor Covenant 2.1), `SECURITY.md`, `SUPPORT.md`, issue and pull request templates,
-  `CODEOWNERS`, and Dependabot configuration.
-
-### Capability snapshot at first public commit
-
-Not a release entry. Recorded so that later changelog entries have a baseline. Every item below is
-implemented and verified locally (evidence tiers L1-L3). L4 verification against real external
-identity providers, downstream SaaS, social providers, and SMS or WhatsApp delivery is not complete
-for any capability, so nothing here is production-supported.
-
-- Worker: 12 core OIDC/OAuth endpoints (the full route surface under `oidc/` and `oauth/` is larger
-  and includes 501 stubs), CIBA, federation, SAML inbound and outbound, SCIM 2.0 (Bulk,
-  ETag), legacy LDAP / WS-Fed / SWA / header auth, Management API under `/v1/*`
-- Hosted UI: 12 auth page types, account portal (5 pages), organization console, platform console
-- Kernel libraries: protocol, webauthn, crypto, saml, db, i18n, types
-- 15 TypeScript SDKs: core, backend, react, nextjs, vue, nuxt, svelte, solid, angular, astro, remix,
-  react-native, expo, electron, tauri
-- 13 native SDKs: Go, Rust, Python, Ruby, PHP, Java, .NET, iOS, macOS, Windows, Linux, Android,
-  Flutter. These are not published to any package registry. CI runs no language toolchain and none
-  of their test suites; `tests/native-sdk-contract.test.mjs` only asserts that every platform in the
-  contract matrix points at a directory that exists.
-- i18n: 8 locales (en, zh-Hans, ja, ko, fr, de, es, pt-BR), catalogs fully translated
+### Changed
+- **web:** 将官网统一为 Nimbus 并隔离 Console ([9b0b37b](https://github.com/StringKe/xid/commit/9b0b37b723083817c35422e9a0af48dbde0a2d8d))
+
+### Documentation
+- **readme:** Correct project status for live L4 evidence (#61) ([0b722d6](https://github.com/StringKe/xid/commit/0b722d6d4c3bb85fe74db35b19a12632376f6b3e))
+- **security:** Complete OpenSSF Best Practices Passing evidence (#58) ([df3f696](https://github.com/StringKe/xid/commit/df3f6960b2151906e64cff312d428673fc9b86f1))
+- **readme:** Sync capabilities and launch badges (#42) ([7c48bb5](https://github.com/StringKe/xid/commit/7c48bb5ccb6c6e8d92eb85da4dbe581b55efebfd))
+- **design:** Sync access request model into chapters 02/03/06/08 ([5e20f04](https://github.com/StringKe/xid/commit/5e20f04bb0913ea4460efaf833abba48dac5b4a7))
+- **design:** Sync org unit model into chapters 02/08 ([751ce1f](https://github.com/StringKe/xid/commit/751ce1f8fe89af7c697322a9ffc6f86e4f1cbef2))
+- Record guest upgrade and silent re-auth in changelog and readme ([70156b1](https://github.com/StringKe/xid/commit/70156b19ecdfe39b73f32de5acb17836ddd9f5fd))
+- Repair broken markdown tables in protocol and SDK references ([e828336](https://github.com/StringKe/xid/commit/e8283360383cb8fabd91c4bc9754e202548b99b7))
+- **sdks:** Document guest upgrade and silent re-auth APIs in SDK references ([683a016](https://github.com/StringKe/xid/commit/683a0165b9347e1bf2ca294f65c60bbf4aadf9f9))
+- **design:** Add SDK guest one-click upgrade and silent re-auth transport ([b1ae477](https://github.com/StringKe/xid/commit/b1ae477af65dd54e1183e42f0e454830d3f178df))
+- **deployment:** Mark cloudflare security rules as reconciled ([458b785](https://github.com/StringKe/xid/commit/458b785d070993cd68bc50cbf883fd54a6309d1e))
+- **security:** 记录 OpenSSF 项目登记 ([d6c2169](https://github.com/StringKe/xid/commit/d6c21690f50c1b1e2c7176d0be7e3345232272f6))
+- **security:** 完成安全修复证据收尾 ([00a0014](https://github.com/StringKe/xid/commit/00a00148e8559861f9b6ab1c620d07754f8a8fec))
+
+### Testing
+- **server:** Access request end-to-end flow ([0aa39cd](https://github.com/StringKe/xid/commit/0aa39cd77b6a1011f2684cc4bfdfe41eb7c4521c))
+- **server:** Org unit isolation and guard coverage ([22f3d49](https://github.com/StringKe/xid/commit/22f3d493bbba6056624eb959b35449680dfae0bb))
+- **smoke:** Align console copy assertions with the shared page skeleton ([98cc53e](https://github.com/StringKe/xid/commit/98cc53ea3d205fb39c261f0d2875a71136953575))
+- **crypto:** Allow CI budget for property test ([9c4b3c3](https://github.com/StringKe/xid/commit/9c4b3c3fb364c3ee259cdae390f485ffe31a898d))
+
+### Build
+- **codeql:** Path-gate native language analysis on pull requests (#60) ([e42180f](https://github.com/StringKe/xid/commit/e42180f7f02cae244fbda3ce43033dbe541fcc10))
+
+### Dependencies
+- **deps:** Bump the gradle group in /sdk/android with 15 updates ([f177981](https://github.com/StringKe/xid/commit/f1779818d277c2aff1825a69f01f5dd380b35b93))
+- **deps:** Bump the nuget group with 4 updates ([286bdb4](https://github.com/StringKe/xid/commit/286bdb47ccd4d71cccc786e88d2dd80a5aabbac4))
+- **deps:** Bump the pub group in /sdk/flutter with 3 updates ([c0608ae](https://github.com/StringKe/xid/commit/c0608ae8fb062c906c7e93a013efad710ca379ba))
+- **deps:** Bump the cargo group across 2 directories with 8 updates ([6712bf2](https://github.com/StringKe/xid/commit/6712bf281cbe2fc777a3ef493ed72ed83c9c29df))
+- **deps:** Bump the pip group in /sdk/python with 8 updates ([bc5189f](https://github.com/StringKe/xid/commit/bc5189fa5c96699524a4a1e68eaa93f06ef282d3))
+- **deps:** Bump github.com/golang-jwt/jwt/v5 ([cc8c570](https://github.com/StringKe/xid/commit/cc8c570191301c2ab5d148a4f6b57543d514b736))
+
+### Maintenance
+- **gitignore:** Drop redundant patterns and clarify local AI ignore ([1706cd9](https://github.com/StringKe/xid/commit/1706cd9987ea804f0d85266ed4b8f110c40d14b6))
+- **comments:** Purge residual and compress verbose source comments ([532148b](https://github.com/StringKe/xid/commit/532148b64ae77ee5570921a19de28d4d813dda8b))
+- **db:** Format 0014 snapshot per vp check ([97a4029](https://github.com/StringKe/xid/commit/97a4029f5a4a6b1941a6f18078535e48000f5eab))
+- Retrigger workers builds after webhook loss ([b48d798](https://github.com/StringKe/xid/commit/b48d7984298e4c9428475d4856691d0b0c25d56d))
 
 [Unreleased]: https://github.com/StringKe/xid/commits/main
+[0.0.1]: https://github.com/StringKe/xid/releases/tag/v0.0.1
+
+<!-- generated by git-cliff -->