From fb3f33cd165078a999b0754bd17de3a80e53f322 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:09:07 +0200 Subject: [PATCH 01/13] Prepare version 0.3.4 --- build.gradle.kts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle.kts b/build.gradle.kts index d30677c..e96f812 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -3,7 +3,7 @@ plugins { } group = "dev.workflowguard" -version = "0.3.3" +version = "0.3.4" repositories { mavenCentral() From e60cf4d31e078b4073d408e93b8cceb5665b1b97 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:09:10 +0200 Subject: [PATCH 02/13] Finalize 0.3.4 changelog --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 77bff49..59f2519 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## Unreleased +## 0.3.4 - 2026-09-24 ### Security From f3acd4c59fac8161a24c6bbb468b0addf08482df Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:09:14 +0200 Subject: [PATCH 03/13] Update README for 0.3.4 --- README.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index d39b677..d4131f7 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ WorkflowGuard is a state-aware workflow mutation engine for Burp Suite. It captures a legitimate multi-step HTTP process, generates controlled out-of-order variants, and is designed to detect business-logic violations by comparing application state before and after execution. > [!IMPORTANT] -> The repository contains the complete `0.3.3` local MVP described in the roadmap. The intentionally excluded items remain listed under **Explicitly out of the MVP** in the roadmap. +> The repository contains the complete `0.3.4` local MVP described in the roadmap. The intentionally excluded items remain listed under **Explicitly out of the MVP** in the roadmap. ## What makes WorkflowGuard different @@ -60,8 +60,9 @@ state. The project includes the Gradle Wrapper, so a separate Gradle installation is not required. -WorkflowGuard `0.3.3` has been exercised end-to-end on Burp Suite Community -Edition `2026.7.1`. Community can load and run the extension, but Burp reserves +WorkflowGuard's runtime behavior was exercised end-to-end on Burp Suite Community +Edition `2026.7.1` during the `0.3.3` validation campaign. Version `0.3.4` is a +release-hardening update with no intended workflow-execution behavior changes. Community can load and run the extension, but Burp reserves project files and the **All issues** viewer for Professional. WorkflowGuard therefore keeps full run evidence in its own tab, supports redacted JSON and portable workflow exports, and labels Burp issue publication as **Pro viewer @@ -85,7 +86,7 @@ On Linux or macOS: The loadable extension is produced at: ```text -build/libs/workflowguard-0.3.3.jar +build/libs/workflowguard-0.3.4.jar ``` ## Load in Burp Suite @@ -129,6 +130,7 @@ See [Development workflow](docs/development.md), [authenticated laboratory validation](docs/ui-authenticated-validation-20260730.md), [BApp readiness matrix](docs/bapp-readiness.md), [BApp submission text](docs/bapp-submission.md), +[0.3.4 release notes](docs/release-notes-0.3.4.md), [0.3.3 release notes](docs/release-notes-0.3.3.md), [release integrity process](docs/release-integrity.md), [Invariant language](docs/invariants.md), From 32aaf5644e2ccdf85b32870dad3effa31b644af7 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:09:34 +0200 Subject: [PATCH 04/13] Update BApp submission for 0.3.4 --- docs/bapp-submission.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/bapp-submission.md b/docs/bapp-submission.md index e0377d5..e332755 100644 --- a/docs/bapp-submission.md +++ b/docs/bapp-submission.md @@ -13,7 +13,7 @@ cleanup. ## Current extension-portal form - **Extension URL:** `https://github.com/aleff-github/WorkflowGuard` -- **Version number:** `0.3.3` +- **Version number:** `0.3.4` - **Additional compatible products and features:** select **Community** only. Professional is included automatically; WorkflowGuard does not claim DAST or Burp AI integration. @@ -58,7 +58,7 @@ viewer and persistent project files are Professional-only. ## Installation 1. Build with `./gradlew clean test jar`, or install the published BApp. -2. For a manual build, load `build/libs/workflowguard-0.3.3.jar` as a Java +2. For a manual build, load `build/libs/workflowguard-0.3.4.jar` as a Java extension under **Extensions → Installed**. 3. Open the **WorkflowGuard** suite tab. @@ -79,7 +79,7 @@ systems they own or are authorized to assess. - Java 21 - Montoya API `2026.7` -- Validated with Burp Suite Community Edition `2026.7.1` +- Runtime/UI behavior validated with Burp Suite Community Edition `2026.7.1` during the `0.3.3` campaign; `0.3.4` contains release/security hardening with no intended workflow-execution behavior changes - Dependencies bundled in the release JAR - GPL-3.0-only - Offline operation; no telemetry or cloud dependency From 831d6ead1412e7c2b5dd10dc9f235f7ab6302681 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:09:36 +0200 Subject: [PATCH 05/13] Align BApp readiness with 0.3.4 --- docs/bapp-readiness.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/bapp-readiness.md b/docs/bapp-readiness.md index 92fcc5a..f341802 100644 --- a/docs/bapp-readiness.md +++ b/docs/bapp-readiness.md @@ -6,7 +6,7 @@ PortSwigger criteria revision checked: 2026-09-22 ## Verdict -WorkflowGuard `0.3.3` continues to satisfy the current technical BApp Store +WorkflowGuard `0.3.4` continues to satisfy the current technical BApp Store acceptance criteria. The source repository is public and suitable for PortSwigger review. @@ -35,7 +35,7 @@ extension-portal issue form. - Clean JDK 21 build: `.\gradlew.bat clean test jar --no-daemon --rerun-tasks`. -- Automated baseline: **88 tests**, zero failures, zero errors, one opt-in +- Automated baseline for the release line: **88 tests**, zero failures, zero errors, one opt-in credential-dependent laboratory test skipped, across 26 test suites. - Burp Suite Community Edition `2026.7.1`: direct `0.3.3` UI validation confirmed load, portable workflow import, mutation generation, unsafe raw @@ -70,8 +70,10 @@ The exact final verification commands and UI observations are recorded in - Maven Central currently lists Montoya API `2026.7`, which remains the compile-time API used by WorkflowGuard. - Direct runtime/UI validation evidence in this repository remains against - Burp Suite Community Edition `2026.7.1`. This document does not claim a - completed direct `2026.9` regression campaign. + Burp Suite Community Edition `2026.7.1` from the `0.3.3` campaign. Version + `0.3.4` changes dependency/release hardening and documentation, not the + workflow execution semantics. This document does not claim a completed direct + `2026.9` regression campaign. ## Submission fields From e21f7e91c467f30f7b2467cb8fcf91b30181b35b Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:09:51 +0200 Subject: [PATCH 06/13] Add 0.3.4 release notes --- docs/release-notes-0.3.4.md | 45 +++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 docs/release-notes-0.3.4.md diff --git a/docs/release-notes-0.3.4.md b/docs/release-notes-0.3.4.md new file mode 100644 index 0000000..3212a41 --- /dev/null +++ b/docs/release-notes-0.3.4.md @@ -0,0 +1,45 @@ +# WorkflowGuard 0.3.4 + +WorkflowGuard `0.3.4` is a release-integrity and security-maintenance release +prepared for BApp Store submission. It intentionally avoids changing the core +workflow-execution semantics validated in the `0.3.3` campaign. + +## Security and dependency maintenance + +- Update Jackson Databind and aligned Jackson runtime components to `2.22.3`. +- Keep Gradle dependency locking enabled. +- Use Gradle Wrapper `9.7.1` with a pinned distribution checksum. +- Update `actions/setup-java` to the pinned `6.0.1` commit. + +## Release integrity + +- Verify the distributable JAR in CI. +- Reject a build if Montoya API classes are accidentally bundled. +- Reject duplicate JAR entries. +- Generate and verify a SHA-256 file from the exact built artifact. +- Add a tag-driven release workflow that requires the Git tag and Gradle + project version to match. +- Publish the same verified JAR/checksum pair produced by the release workflow. +- Document the historical `0.3.3` validation-build versus release-asset + checksum discrepancy. + +## BApp Store preparation + +- Refresh the BApp Store readiness assessment against PortSwigger's + 2026-09-22 acceptance criteria. +- Update the submission text and explicitly distinguish WorkflowGuard from + Sequence Comparer, AuthMatrix, Autorize, Auth Analyzer, and API Workflow + Manager. +- Keep Community compatibility declared; no DAST or Burp AI integration is + claimed. + +## Validation + +- The release candidate is built and tested by GitHub Actions on JDK 21. +- The CI pipeline verifies the final JAR layout and checksum generation. +- Direct runtime/UI evidence remains the Burp Suite Community Edition + `2026.7.1` campaign performed for `0.3.3`; `0.3.4` does not intentionally + alter workflow execution behavior. + +The canonical binary checksum for `0.3.4` is generated automatically by the +release workflow and published alongside the JAR. From 73c940f0ceab21a8e5dfa019c0f97ab17c3036cb Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:11:08 +0200 Subject: [PATCH 07/13] Automate release tag creation --- .github/workflows/tag-release.yml | 69 +++++++++++++++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 .github/workflows/tag-release.yml diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml new file mode 100644 index 0000000..ed5a970 --- /dev/null +++ b/.github/workflows/tag-release.yml @@ -0,0 +1,69 @@ +name: Tag release version + +on: + push: + branches: + - main + paths: + - build.gradle.kts + +permissions: + contents: write + +jobs: + tag: + runs-on: ubuntu-latest + timeout-minutes: 5 + + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + fetch-depth: 0 + + - name: Create release tag for a version bump + shell: bash + run: | + set -euo pipefail + + version_from_file() { + sed -nE 's/^version = "([^"]+)"$/\1/p' "$1" | head -n 1 + } + + current_version="$(version_from_file build.gradle.kts)" + if [[ -z "$current_version" ]]; then + echo "Unable to read the project version from build.gradle.kts." >&2 + exit 1 + fi + + previous_version="" + if git rev-parse "${GITHUB_SHA}^" >/dev/null 2>&1; then + previous_file="$(mktemp)" + if git show "${GITHUB_SHA}^:build.gradle.kts" > "$previous_file" 2>/dev/null; then + previous_version="$(version_from_file "$previous_file")" + fi + rm -f "$previous_file" + fi + + if [[ "$previous_version" == "$current_version" ]]; then + echo "Project version did not change ($current_version); no release tag needed." + exit 0 + fi + + tag="v$current_version" + git fetch --tags --force + + if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then + existing_commit="$(git rev-list -n 1 "$tag")" + if [[ "$existing_commit" != "$GITHUB_SHA" ]]; then + echo "Tag $tag already exists at $existing_commit, not $GITHUB_SHA." >&2 + exit 1 + fi + echo "Tag $tag already points to this release commit." + exit 0 + fi + + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git tag -a "$tag" -m "WorkflowGuard $current_version" "$GITHUB_SHA" + git push origin "$tag" From a4c9b75d25f1a54f100df308bd224c8ffd25309e Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:11:31 +0200 Subject: [PATCH 08/13] Document automatic release tagging --- docs/release-integrity.md | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/docs/release-integrity.md b/docs/release-integrity.md index fb31f76..ee37ae5 100644 --- a/docs/release-integrity.md +++ b/docs/release-integrity.md @@ -9,17 +9,20 @@ the release notes all refer to the same build. 1. Update the Gradle project version and create matching `docs/release-notes-X.Y.Z.md`. 2. Merge all intended changes to `main` and require a green Build workflow. -3. Create and push the annotated tag `vX.Y.Z` from the exact release commit. -4. Do not create the GitHub release manually before pushing the tag. -5. Let `.github/workflows/release.yml` build, test, verify, checksum, and - publish the release artifacts. +3. A version change in `build.gradle.kts` on `main` triggers + `.github/workflows/tag-release.yml`, which creates the annotated + `vX.Y.Z` tag at that exact release commit. +4. Do not create the GitHub release manually. +5. The tag triggers `.github/workflows/release.yml`, which builds, tests, + verifies, checksums, and publishes the release artifacts. 6. Download the published JAR and `.sha256` file and verify them independently before submitting or updating the BApp Store entry. -The release workflow fails if the tag version does not match the Gradle project -version, if more than one WorkflowGuard JAR is produced, if Montoya API classes -are bundled, if duplicate JAR entries are present, or if release notes are -missing. +The tag workflow only creates a release tag when the project version actually +changes. The release workflow fails if the tag version does not match the Gradle +project version, if more than one WorkflowGuard JAR is produced, if Montoya API +classes are bundled, if duplicate JAR entries are present, or if release notes +are missing. ## Historical correction for 0.3.3 @@ -40,5 +43,6 @@ These are different binary builds. The July validation checksum must therefore not be used to verify the currently attached release asset. The release page body should be corrected manually to remove the stale size and checksum. -Starting with the next release, the release workflow is the canonical producer -of both the JAR and its checksum. +Starting with `0.3.4`, the automated tag/release workflows are the canonical +release path and the release workflow is the canonical producer of both the JAR +and its checksum. From 242f6cf012a031d767888e1113ff31dcd75c9b98 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:11:42 +0200 Subject: [PATCH 09/13] Document automated release tagging --- CHANGELOG.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 59f2519..662d216 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,8 +11,9 @@ ### Changed -- Add a tag-driven release workflow that requires the tag version to match the - Gradle project version and publishes the same verified JAR/checksum pair. +- Add automatic annotated release tagging for version bumps on `main` plus a + tag-driven release workflow that requires the tag version to match the Gradle + project version and publishes the same verified JAR/checksum pair. - Document the `0.3.3` validation-build versus release-asset checksum discrepancy so historical evidence is not mistaken for the attached binary. - Refresh the BApp Store readiness review against PortSwigger's From ab059aa1bd3ccaf66f2074f51cae516b33be2e22 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:11:44 +0200 Subject: [PATCH 10/13] Update 0.3.4 release automation notes --- docs/release-notes-0.3.4.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/release-notes-0.3.4.md b/docs/release-notes-0.3.4.md index 3212a41..75c845d 100644 --- a/docs/release-notes-0.3.4.md +++ b/docs/release-notes-0.3.4.md @@ -17,6 +17,8 @@ workflow-execution semantics validated in the `0.3.3` campaign. - Reject a build if Montoya API classes are accidentally bundled. - Reject duplicate JAR entries. - Generate and verify a SHA-256 file from the exact built artifact. +- Add automatic annotated tagging when the Gradle project version changes on + `main`. - Add a tag-driven release workflow that requires the Git tag and Gradle project version to match. - Publish the same verified JAR/checksum pair produced by the release workflow. From 4f099a84fd76aa8fab45978a9310962ab679e850 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:12:42 +0200 Subject: [PATCH 11/13] Allow explicit release workflow dispatch --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 63b00c7..18fda84 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,7 @@ on: push: tags: - "v*" + workflow_dispatch: permissions: contents: write From d774611017ad5506183b181660fcc949c59d42ec Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:12:44 +0200 Subject: [PATCH 12/13] Dispatch release after automatic tag --- .github/workflows/tag-release.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml index ed5a970..8b05089 100644 --- a/.github/workflows/tag-release.yml +++ b/.github/workflows/tag-release.yml @@ -8,6 +8,7 @@ on: - build.gradle.kts permissions: + actions: write contents: write jobs: @@ -23,6 +24,8 @@ jobs: - name: Create release tag for a version bump shell: bash + env: + GH_TOKEN: ${{ github.token }} run: | set -euo pipefail @@ -60,10 +63,17 @@ jobs: exit 1 fi echo "Tag $tag already points to this release commit." + else + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git tag -a "$tag" -m "WorkflowGuard $current_version" "$GITHUB_SHA" + git push origin "$tag" + fi + + if gh release view "$tag" >/dev/null 2>&1; then + echo "Release $tag already exists; nothing to dispatch." exit 0 fi - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git tag -a "$tag" -m "WorkflowGuard $current_version" "$GITHUB_SHA" - git push origin "$tag" + gh workflow run release.yml --ref "$tag" + echo "Dispatched release.yml for $tag." From f662d718861bfea7c807f2e5a6005ca5e113bbd9 Mon Sep 17 00:00:00 2001 From: Aleff Date: Thu, 24 Sep 2026 16:13:09 +0200 Subject: [PATCH 13/13] Clarify release workflow dispatch --- docs/release-integrity.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/release-integrity.md b/docs/release-integrity.md index ee37ae5..3ed02cf 100644 --- a/docs/release-integrity.md +++ b/docs/release-integrity.md @@ -13,8 +13,10 @@ the release notes all refer to the same build. `.github/workflows/tag-release.yml`, which creates the annotated `vX.Y.Z` tag at that exact release commit. 4. Do not create the GitHub release manually. -5. The tag triggers `.github/workflows/release.yml`, which builds, tests, - verifies, checksums, and publishes the release artifacts. +5. The tag workflow explicitly dispatches `.github/workflows/release.yml` + after creating the tag. Manually pushed release tags can also trigger the + release workflow directly. The release workflow builds, tests, verifies, + checksums, and publishes the release artifacts. 6. Download the published JAR and `.sha256` file and verify them independently before submitting or updating the BApp Store entry.