[preset] Add Secure Development Assurance Governance preset - #4513
Conversation
Add secure-development-assurance-governance preset submitted by @hindermath to: - presets/catalog.community.json (alphabetical order) - docs/community/presets.md community presets table Closes #4455 Assisted-by: GitHub Copilot (model: gpt-5.2-codex, autonomous) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
The only remaining comment is a non-blocking documentation nit.
Pull request overview
Adds the secure-development-assurance-governance v0.1.3 community preset.
Changes:
- Registers the preset in
presets/catalog.community.json. - Documents it in
docs/community/presets.md.
File summaries
| File | Summary |
|---|---|
presets/catalog.community.json |
Added the preset catalog entry and timestamp. |
docs/community/presets.md |
Added the community preset documentation row; a non-blocking prerequisite note remains. |
Review details
Suppressed comments (1)
docs/community/presets.md:35
- This preset's bundled Bash and PowerShell validators require
.specify/presets/security-governance/preset.ymlat version>=0.6.1; with—in the Requires column, users following the catalog are not told about a prerequisite and a fresh install will fail validation. Please listsecurity-governance >=0.6.1here, as the table already does for the parallel governance preset.
| Secure Development Assurance Governance | Validates project-owned secure-development manifests, hashes, checklists, reviews, risks, closure, and image-impact evidence without granting human approvals or certifications. | 1 template, 2 commands, 2 scripts | — | [spec-kit-preset-secure-development-assurance-governance](https://github.com/hindermath/spec-kit-preset-secure-development-assurance-governance) |
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🟡 Changes recommended
Update the documentation’s Requires cell to — to match the catalog.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
The documentation omits the required security-governance >=0.6.1 dependency.
Review details
Suppressed comments (1)
docs/community/presets.md:35
- This
—hides a real prerequisite: the published v0.1.3 README requiressecurity-governance >=0.6.1, and both bundled validators fail when.specify/presets/security-governance/preset.ymlis absent. Please advertise that required preset in theRequirescolumn; otherwise users following the catalog will install a preset that cannot validate in a fresh project.
| Secure Development Assurance Governance | Validates project-owned secure-development manifests, hashes, checklists, reviews, risks, closure, and image-impact evidence without granting human approvals or certifications. | 1 template, 2 commands, 2 scripts | — | [spec-kit-preset-secure-development-assurance-governance](https://github.com/hindermath/spec-kit-preset-secure-development-assurance-governance) |
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
|
Noted the runtime prerequisite and the Copilot reviewer's concern. The shipped validators intentionally fail closed unless the separately installed However, this catalog’s requires metadata and the table’s Requires column currently model extensions only; security-governance is a preset, and Spec Kit does not yet support declarative preset-to-preset dependencies. We should therefore retain |
Add the new
secure-development-assurance-governancev0.1.3 community preset submitted by@hindermath.Updated:
presets/catalog.community.jsonwith the alphabetically ordered preset entry and current catalog timestamp.docs/community/presets.mdwith the alphabetically ordered community preset table row.Validation passed for the preset ID, semver version, public repository,
preset.yml,LICENSE, documentation README, exactspecify preset add --fromcommand, release tag, and required issue checklists.Closes #4455
cc
@hindermath