Prepare v1.3.0 release and security fixes (#127)

Signed-off-by: Sherif Mansour <13433538+kerberosmansour@users.noreply.github.com>

Author: kerberosmansour

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -24,6 +24,8 @@ body:
         - "@hulumi/policies"
         - "@hulumi/drift"
         - "@hulumi/k8s-baseline"
+        - "@hulumi/cloudflare-baseline"
+        - "@hulumi/platform-patterns"
         - "/hulumi-threat-model skill"
         - "release / CI workflow"
         - "docs"
@@ -59,8 +61,8 @@ body:
     id: version
     attributes:
       label: Package version(s)
-      description: Output of `pnpm list @hulumi/baseline @hulumi/policies @hulumi/drift @hulumi/k8s-baseline @pulumi/aws @pulumi/pulumi @pulumi/kubernetes`.
-      placeholder: e.g. `@hulumi/baseline 1.2.0`, `@pulumi/aws 7.27.0`, `@pulumi/pulumi 3.232.0`
+      description: Output of `pnpm list @hulumi/baseline @hulumi/policies @hulumi/drift @hulumi/k8s-baseline @hulumi/cloudflare-baseline @hulumi/platform-patterns @pulumi/aws @pulumi/pulumi @pulumi/kubernetes @pulumi/cloudflare`.
+      placeholder: e.g. `@hulumi/baseline 1.3.0`, `@pulumi/aws 7.27.0`, `@pulumi/pulumi 3.232.0`
     validations:
       required: true
   - type: input

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -23,6 +23,8 @@ body:
         - New component in @hulumi/baseline (AWS)
         - New component in @hulumi/baseline (GitHub)
         - New component in @hulumi/k8s-baseline
+        - New component in @hulumi/cloudflare-baseline
+        - New component in @hulumi/platform-patterns
         - New rule in @hulumi/policies
         - New adapter in @hulumi/drift
         - New /hulumi-threat-model scenario

.github/PULL_REQUEST_TEMPLATE.md

@@ -27,7 +27,7 @@
 - [ ] No secrets, credentials, or `.env` files included
 - [ ] No verbatim control text from CSA / CIS / NIST / MITRE frameworks (IDs-only — see [SECURITY.md](../SECURITY.md) and [docs/mappings/licensing.md](../docs/mappings/licensing.md))
 - [ ] Docs updated if behavior or surface changed (README, ARCHITECTURE.md, component docs, CHANGELOG)
-- [ ] If a new dependency was added to `@hulumi/baseline`, `@hulumi/policies`, `@hulumi/drift`, or `@hulumi/k8s-baseline`, the supply-chain rationale is in the PR body (see CONTRIBUTING.md)
+- [ ] If a new dependency was added to a publishable `@hulumi/*` package, the supply-chain rationale is in the PR body (see CONTRIBUTING.md)
 
 ## Notes for the reviewer
 

.github/attestations/README.md

@@ -8,17 +8,17 @@ covers verification via `gh attestation verify` and `cosign`.
 
 ```sh
 # Download the tarball
-pnpm pack @hulumi/baseline@1.0.0 --pack-destination .
+pnpm pack @hulumi/baseline@1.3.0 --pack-destination .
 
 # Verify the attestation
-gh attestation verify ./hulumi-baseline-1.0.0.tgz \
+gh attestation verify ./hulumi-baseline-1.3.0.tgz \
   --repo kerberosmansour/hulumi
 ```
 
 Expected output:
 
 ```
-Loaded digest sha256:<sha> for file://./hulumi-baseline-1.0.0.tgz
+Loaded digest sha256:<sha> for file://./hulumi-baseline-1.3.0.tgz
 Loaded 1 attestation from GitHub API
 ✓ Verification succeeded!
 
@@ -29,7 +29,9 @@ The following policy criteria were satisfied:
 - Commit: <sha>
 ```
 
-Repeat for `@hulumi/policies@1.0.0` and `@hulumi/drift@1.0.0`.
+Repeat for the other published packages in the same version train:
+`@hulumi/policies`, `@hulumi/drift`, `@hulumi/k8s-baseline`,
+`@hulumi/cloudflare-baseline`, and `@hulumi/platform-patterns`.
 
 A non-zero exit code from `gh attestation verify` means the
 attestation chain doesn't tie back to this repo's release
@@ -42,26 +44,26 @@ If you can't reach the GitHub API:
 
 ```sh
 # Download the tarball + the attestation
-pnpm pack @hulumi/baseline@1.0.0 --pack-destination .
-gh release download v1.0.0 \
+pnpm pack @hulumi/baseline@1.3.0 --pack-destination .
+gh release download v1.3.0 \
   --repo kerberosmansour/hulumi \
-  --pattern "hulumi-baseline-1.0.0.tgz.intoto.jsonl" \
+  --pattern "hulumi-baseline-1.3.0.tgz.intoto.jsonl" \
   --dir .
 
 # Verify with cosign (assumes a recent cosign + Sigstore root)
 cosign verify-blob \
-  --bundle ./hulumi-baseline-1.0.0.tgz.intoto.jsonl \
+  --bundle ./hulumi-baseline-1.3.0.tgz.intoto.jsonl \
   --certificate-identity-regexp '^https://github.com/kerberosmansour/hulumi/' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-  ./hulumi-baseline-1.0.0.tgz
+  ./hulumi-baseline-1.3.0.tgz
 ```
 
 ## What attestation guarantees
 
 - The tarball was built by GitHub Actions running
   `.github/workflows/release.yml` from the
   `kerberosmansour/hulumi` repo.
-- The exact commit SHA at build time matches the `v1.0.0` tag.
+- The exact commit SHA at build time matches the release tag.
 - The build was hermetic (no maintainer-side `npm publish`).
 - The publish used npm trusted publishing (OIDC); no
   long-lived `NPM_TOKEN` was involved.

.github/dependabot.yml

@@ -3,7 +3,7 @@
 # .github/workflows/pulumi-cooling-off.yml on every PR — Dependabot
 # proposes the bump, the cooling-off CI gate decides whether the PR
 # can merge. @pulumi/* deps are grouped so a coherent bump stays
-# atomic across the three Hulumi packages.
+# atomic across the six Hulumi packages.
 #
 # Major-version bumps on the toolchain below are conscious migrations with
 # code-level fallout (e.g. TypeScript 6's moduleResolution=node10
@@ -22,7 +22,7 @@ updates:
     labels:
       - "dependencies"
     # Group @pulumi/* together so cooling-off stays atomic across the
-    # three Hulumi packages; group remaining dev deps for noise control.
+    # six Hulumi packages; group remaining dev deps for noise control.
     groups:
       pulumi-runtime:
         patterns:

.github/workflows/ci.yml

@@ -83,6 +83,11 @@ jobs:
       - run: pnpm --filter @hulumi/drift build
       - run: pnpm --filter @hulumi-examples/drift-classify-smoke typecheck
       - run: pnpm --filter @hulumi-examples/drift-classify-smoke test
+      - run: pnpm --filter @hulumi/cloudflare-baseline build
+      - run: pnpm --filter @hulumi/platform-patterns build
+      - run: pnpm --filter @hulumi/policies build
+      - run: pnpm --filter @hulumi/example-edge-platform-smoke typecheck
+      - run: pnpm --filter @hulumi/example-edge-platform-smoke test
 
   k8s-baseline-test:
     name: "@hulumi/k8s-baseline unit + release-readiness BDD"
@@ -192,7 +197,7 @@ jobs:
         run: |
           mkdir -p .release-artifacts
           ABS_DEST="$(pwd)/.release-artifacts"
-          for pkg in baseline policies drift k8s-baseline; do
+          for pkg in baseline policies drift k8s-baseline cloudflare-baseline platform-patterns; do
             (cd "packages/$pkg" && pnpm pack --pack-destination "$ABS_DEST")
           done
           ls -la .release-artifacts/

.github/workflows/release.yml

@@ -1,16 +1,18 @@
-# Release — atomic four-package npm publish with SLSA Build L3
+# Release — atomic six-package npm publish with SLSA Build L3
 # attestation + SBOM generation + signed GitHub release.
 #
 # Trigger: tag v*.*.* on main. The release is atomic — any step
 # failure aborts before any `npm publish`. There is NO long-lived
 # NPM_TOKEN; npm trusted publishing via OIDC is the only auth path.
 #
-# The four-package set is asserted by
+# The six-package set is asserted by
 # packages/k8s-baseline/tests/release-readiness.test.ts:
 #   - @hulumi/baseline
 #   - @hulumi/policies
 #   - @hulumi/drift
 #   - @hulumi/k8s-baseline   (added in runbook hulumi-operations-k8s-security M1)
+#   - @hulumi/cloudflare-baseline
+#   - @hulumi/platform-patterns
 
 name: release
 on:
@@ -19,9 +21,7 @@ on:
       - "v*.*.*"
 
 permissions:
-  contents: write
-  id-token: write
-  attestations: write
+  contents: read
 
 jobs:
   preflight:
@@ -73,7 +73,7 @@ jobs:
         run: |
           mkdir -p .release-artifacts
           ABS_DEST="$(pwd)/.release-artifacts"
-          for pkg in baseline policies drift k8s-baseline; do
+          for pkg in baseline policies drift k8s-baseline cloudflare-baseline platform-patterns; do
             (cd "packages/$pkg" && pnpm pack --pack-destination "$ABS_DEST")
           done
           ls -la .release-artifacts/
@@ -96,7 +96,7 @@ jobs:
           FETCH_LICENSE: "true"
         run: |
           set -euo pipefail
-          for pkg in baseline policies drift k8s-baseline; do
+          for pkg in baseline policies drift k8s-baseline cloudflare-baseline platform-patterns; do
             npx --yes @cyclonedx/cdxgen@11.10.0 \
               --type js \
               --no-recurse \
@@ -117,6 +117,8 @@ jobs:
           pnpm --filter @hulumi/policies publish --no-git-checks --provenance --access public
           pnpm --filter @hulumi/drift publish --no-git-checks --provenance --access public
           pnpm --filter @hulumi/k8s-baseline publish --no-git-checks --provenance --access public
+          pnpm --filter @hulumi/cloudflare-baseline publish --no-git-checks --provenance --access public
+          pnpm --filter @hulumi/platform-patterns publish --no-git-checks --provenance --access public
 
       - name: Create GitHub release with SBOMs + tarballs
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3

CHANGELOG.md

@@ -5,6 +5,86 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.0] — 2026-05-15
+
+The Hulumi Edge Platform release. Atomic six-package publish:
+`@hulumi/baseline@1.3.0`, `@hulumi/policies@1.3.0`,
+`@hulumi/drift@1.3.0`, `@hulumi/k8s-baseline@1.3.0`, and first public
+publishes for `@hulumi/cloudflare-baseline@1.3.0` and
+`@hulumi/platform-patterns@1.3.0`. All six packages use the same SLSA
+Build L3 + npm provenance release path.
+
+### Added
+
+- **`@hulumi/cloudflare-baseline@1.3.0`** — first release of Cloudflare
+  edge primitives: `ZoneFoundation`, `PublicHostname`, `EdgeWafBaseline`,
+  `BotProtectionBaseline`, and `ProtectedAdminHostname`.
+- **`@hulumi/platform-patterns@1.3.0`** — first release of
+  cross-provider patterns: `CloudflareOriginIngress`,
+  `GitHubAwsOidcDeploymentRole`, `DeploymentRepositoryFoundation`, and
+  `BuildProvenanceFoundation`.
+- **Edge policy coverage** in `@hulumi/policies`: Cloudflare hardening,
+  origin-bypass, deployment-governance, and workflow-governance checks.
+- **Edge smoke and integration lanes**: `examples/edge-platform-smoke/`,
+  Cloudflare/platform integration tests that skip without real credentials,
+  and CI coverage for the new package pair.
+- **Release advisory preparation**: `docs/release/v1.3.0-security-advisories.md`
+  tracks the GHSA registrations to publish after the npm packages are live.
+
+### Security
+
+- **PR #80** — `@hulumi/baseline`: CloudTrail selector-tampering detection
+  now catches selector-changing APIs such as `PutEventSelectors` and
+  `PutInsightSelectors`.
+- **PR #119** — `/hulumi-threat-model`: helper scripts are anchored to the
+  installed skill root so an attacker-controlled workspace cannot shadow the
+  generator helpers.
+- **PR #120** — `@hulumi/policies`: HULUMI-H1 no longer trusts substring
+  parent matches for `SecureBucket`-managed resources, closing a parent-spoof
+  bypass for raw `BucketV2`.
+- **PR #121** — `@hulumi/policies`: CIS 1.16 admin-policy detection now
+  covers inline role/user/group policies and `AdministratorAccess`
+  attachments, not only standalone IAM policies.
+- **PR #122** — deployment SCP guidance: the `hulumi:iac-role` tag guard now
+  denies tag-on-create paths for `iam:CreateRole` and `iam:CreateUser`.
+- **PR #123** — `@hulumi/drift`: `OrphanReconciler.execute()` now requires
+  the in-memory token/action set and refuses externally supplied stale plans.
+- **PR #124** — weekly integration IAM guidance: removed unnecessary role
+  mutation permissions from the documented policy and added regression coverage
+  to keep inline role-policy writes and trust-policy mutation out.
+- **PR #126** — `@hulumi/cloudflare-baseline`: `ProtectedAdminHostname`
+  hostname validation uses bounded parser-style checks before first public
+  publish.
+- **`@hulumi/policies`** — `G_OIDC_1` now inspects AWS set-qualified and
+  `IfExists` condition operators on the GitHub OIDC `sub` claim, closing a
+  bypass where wildcard trusts under `ForAnyValue:StringLike`,
+  `ForAllValues:StringLike`, or set-qualified `StringEquals` variants were
+  missed.
+- **`@hulumi/policies`** — Cloudflare, origin-bypass, and deployment-governance
+  stack validators now require per-resource evidence matching. Unrelated
+  `ZoneDnssec`, `CloudflareOriginIngress`, `DeploymentRepositoryFoundation`,
+  or unscoped OIDC-role resources no longer suppress findings for other zones,
+  hostnames, or deployment repositories.
+
+### Changed
+
+- Release and CI workflows expand from four to six packages for pack,
+  SBOM, attestation, dry-run, and npm publish steps.
+- `release-readiness.test.ts` now enforces the six-package atomic version
+  invariant, per-package README/LICENSE requirements, and the v1.3 changelog
+  entry.
+- `docs/slo/` is ignored as development-only SLO runbook material, not a
+  user-facing publish artifact.
+- Dependency and workflow governance docs now describe the v1.3 package set
+  and the 13 exact-pinned supply-chain dependencies.
+
+### Migration
+
+For consumers on v1.2.x: existing AWS, GitHub, drift, and K8s surfaces are
+additive. The two new packages are opt-in. Edge-platform real-provider proof
+remains credential-gated; use the smoke example and integration docs before
+promoting Cloudflare/AWS/GitHub edge patterns into production.
+
 ## [1.2.0] — 2026-05-01
 
 The Hulumi-K8s-Security + Hulumi-Operations + pre-public-launch release.

CONTRIBUTING.md

@@ -40,14 +40,14 @@ Before opening a PR, confirm `pnpm -r test && pnpm -r typecheck && pnpm -r lint`
 
 ## No runtime dependency additions without discussion
 
-Adding a runtime dependency to any of `@hulumi/baseline`, `@hulumi/policies`, `@hulumi/drift` is a significant supply-chain decision. Open a GitHub Discussion first describing:
+Adding a runtime dependency to any publishable `@hulumi/*` package is a significant supply-chain decision. Open a GitHub Discussion first describing:
 
 - why the dependency is needed,
 - what the exact version + integrity hash will be,
 - whether the dependency itself carries SLSA provenance,
 - how the 72h/24h cooling-off policy applies to future bumps.
 
-The policy is codified in `SECURITY.md` once M5 lands.
+The policy is codified in `SECURITY.md`.
 
 ## Pre-submit checks
 
@@ -82,7 +82,7 @@ The runbook templates live at [docs/slo/templates/](./docs/slo/templates/). Runb
 ## What is out of scope
 
 - Switching the licence from Apache-2.0 to anything else. The Apache-2.0 + IDs-only-citations stance is load-bearing — see [SECURITY.md](./SECURITY.md) and [docs/mappings/licensing.md](./docs/mappings/licensing.md).
-- Adding new runtime dependencies to `@hulumi/baseline` / `@hulumi/policies` / `@hulumi/drift` / `@hulumi/k8s-baseline` without supply-chain rationale (see "No runtime dependency additions without discussion" above).
+- Adding new runtime dependencies to a publishable `@hulumi/*` package without supply-chain rationale (see "No runtime dependency additions without discussion" above).
 - Extending `/hulumi-threat-model` to non-Apache-2.0-compatible framework prose. Citations only.
 
 ## Code of Conduct