Revamp footer, add release-please, and update SECURITY.md

.github/workflows/release-please.yml

@@ -0,0 +1,22 @@
+name: Release Please
+
+on:
+    push:
+        branches: [main]
+
+permissions:
+    contents: write
+    pull-requests: write
+
+jobs:
+    release-please:
+        name: Release Please
+        runs-on: ubuntu-24.04
+        steps:
+            - name: Release Please
+              # googleapis/release-please-action v4
+              uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071
+              with:
+                  token: ${{ secrets.GITHUB_TOKEN }}
+                  config-file: release-please-config.json
+                  manifest-file: .release-please-manifest.json

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+    ".": "1.0.0"
+}

README.md

@@ -1,5 +1,7 @@
 # samlguy
 
+[![CI](https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml) [![codecov](https://codecov.io/gh/kellenmurphy/samlguy/graph/badge.svg)](https://codecov.io/gh/kellenmurphy/samlguy) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12859/badge)](https://www.bestpractices.dev/projects/12859)
+
 **SAML assertion and JWT decoder for the IAM community.**
 
 Visit [samlguy.com](https://samlguy.com) — paste whatever messy thing you grabbed from a log file, a network tab, or a browser plugin and the tool figures out what it is and (attempts to) decode it.

SECURITY.md

@@ -70,6 +70,14 @@ Current pins in `.github/workflows/scorecard.yml`:
 - `actions/upload-artifact` — SHA-pinned (v7.0.1)
 - `github/codeql-action/upload-sarif` — SHA-pinned
 
+Current pins in `.github/workflows/release-please.yml`:
+- `googleapis/release-please-action` — SHA-pinned (v4)
+
+Current pins in `.github/workflows/codeql.yml`:
+- `actions/checkout` — SHA-pinned
+- `github/codeql-action/init` — SHA-pinned (v3.28.13)
+- `github/codeql-action/analyze` — SHA-pinned (v3.28.13)
+
 Dependabot is configured to open weekly PRs when new versions of these actions are released, keeping SHA rotation low-friction.
 
 ### Minimal token permissions
@@ -110,6 +118,16 @@ A CodeQL workflow runs on every push and pull request to `main`, and weekly on M
 
 A [Scorecard](https://securityscorecards.dev) workflow runs weekly and on every push to `main`. It evaluates supply-chain security practices (pinned dependencies, branch protection, token permissions, code review, vulnerability disclosure) and publishes results to the GitHub code scanning dashboard. Results are also published publicly to the OSSF scorecard index.
 
+### Branch protection
+
+The `main` branch is protected with the following rules enforced for all contributors including administrators:
+
+- **Required status checks** — the `Build & Test` CI job must pass before any merge is allowed; the branch must be up to date with `main` before merging (strict mode)
+- **Required signatures** — every commit merged to `main` must carry a verified cryptographic signature
+- **Required pull request review** — at least one approval is required; stale approvals are dismissed on new pushes; code owner review is required
+- **No force pushes** — force-pushing to `main` is blocked
+- **No branch deletion** — `main` cannot be deleted
+
 ### CODEOWNERS
 
 `.github/CODEOWNERS` requires `@kellenmurphy` to approve any pull request that touches any file. This ensures no code is merged without review if collaborators are added in the future.
@@ -124,6 +142,14 @@ Property-based fuzz tests (`src/lib/fuzz.test.ts`) run against every parser on e
 
 ---
 
+## Versioning and releases
+
+This project follows [Semantic Versioning](https://semver.org/) (`MAJOR.MINOR.PATCH`). Each release is tagged in the repository with a `v`-prefixed version tag (e.g. `v1.0.0`). Tags are signed with the same SSH key used for commit signing.
+
+Since samlguy.com deploys continuously from `main`, the production deployment always reflects the latest tagged release or the commits immediately following it. Security fixes are released as patch versions and deployed immediately on merge to `main`.
+
+---
+
 ## License
 
 This project is released under the [MIT License](LICENSE). You are free to use, fork, modify, and distribute the code. The only requirement is that the copyright notice is preserved in copies or substantial portions of the software.

package.json

@@ -1,6 +1,6 @@
 {
     "name": "samlguy",
-    "version": "0.0.1",
+    "version": "1.0.0",
     "private": true,
     "type": "module",
     "scripts": {

release-please-config.json

@@ -0,0 +1,19 @@
+{
+    "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+    "release-type": "node",
+    "packages": {
+        ".": {
+            "package-name": "samlguy",
+            "changelog-sections": [
+                { "type": "feat", "section": "Features" },
+                { "type": "fix", "section": "Bug Fixes" },
+                { "type": "perf", "section": "Performance" },
+                { "type": "security", "section": "Security" },
+                { "type": "deps", "section": "Dependencies" },
+                { "type": "docs", "section": "Documentation", "hidden": false },
+                { "type": "chore", "section": "Miscellaneous", "hidden": true },
+                { "type": "ci", "section": "CI/CD", "hidden": true }
+            ]
+        }
+    }
+}

src/routes/+layout.svelte

@@ -97,64 +97,34 @@
     </main>
 
     <footer class="px-6 py-4">
-        <div
-            class="mx-auto flex max-w-5xl flex-col items-center gap-2 text-xs text-neutral-400 dark:text-neutral-600 sm:flex-row sm:flex-wrap sm:justify-center sm:gap-x-3 sm:gap-y-1"
-        >
+        <div class="mx-auto flex max-w-5xl flex-wrap items-center justify-center gap-x-3 gap-y-1 text-[10px] text-neutral-400 dark:text-neutral-600">
+            <a href="/privacy" class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400">Privacy</a>
+            <span aria-hidden="true">&middot;</span>
             <a
-                href="/privacy"
+                href="https://github.com/kellenmurphy/samlguy/security"
+                target="_blank"
+                rel="noopener noreferrer"
                 class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400"
-                >Privacy</a
+                >Security</a
+            >
+            <span aria-hidden="true">&middot;</span>
+            <span>Made with ♥ by <a href="https://kellenmurphy.com" class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400">The SAML Guy</a></span>
+            <span aria-hidden="true">&middot;</span>
+            <a
+                href="https://github.com/kellenmurphy/samlguy"
+                target="_blank"
+                rel="noopener noreferrer"
+                class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400"
+                >Source</a
+            >
+            <span aria-hidden="true">&middot;</span>
+            <a
+                href="https://github.com/kellenmurphy/samlguy/blob/main/LICENSE"
+                target="_blank"
+                rel="noopener noreferrer"
+                class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400"
+                >MIT License</a
             >
-            <span aria-hidden="true" class="hidden sm:inline">&middot;</span>
-            <span>
-                Made with ♥ by <a
-                    href="https://kellenmurphy.com"
-                    class="transition-colors hover:text-neutral-600 dark:hover:text-neutral-400"
-                    >The SAML Guy</a
-                >
-            </span>
-            <span aria-hidden="true" class="hidden sm:inline">&middot;</span>
-            <span class="flex items-center gap-2">
-                <a
-                    href="https://github.com/kellenmurphy/samlguy"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    aria-label="GitHub repository"
-                >
-                    <svg
-                        viewBox="0 0 16 16"
-                        fill="currentColor"
-                        class="h-4 w-4 text-neutral-900 dark:text-neutral-100"
-                        aria-hidden="true"
-                    >
-                        <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0 0 16 8c0-4.42-3.58-8-8-8z" />
-                    </svg>
-                </a>
-                <a
-                    href="https://github.com/kellenmurphy/samlguy/actions/workflows/ci.yml"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    aria-label="CI status"
-                >
-                    <img
-                        src="https://img.shields.io/github/actions/workflow/status/kellenmurphy/samlguy/ci.yml?branch=main&style=flat-square&label=CI&labelColor=404040"
-                        alt="CI status"
-                        class="h-4"
-                    />
-                </a>
-                <a
-                    href="https://app.codecov.io/gh/kellenmurphy/samlguy"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    aria-label="Code coverage"
-                >
-                    <img
-                        src="https://img.shields.io/codecov/c/github/kellenmurphy/samlguy?style=flat-square&label=coverage&labelColor=404040"
-                        alt="Code coverage"
-                        class="h-4"
-                    />
-                </a>
-            </span>
         </div>
     </footer>
 </div>