Software Release and Advisory Ledger (AP-026)

AP-026 turns official GitHub repository, release, and repository-security-advisory data into a deterministic evidence snapshot and, when a persistent baseline store is supplied, an explicit change ledger. It is designed for evidence monitoring—not release recommendation, dependency scanning, exploitability analysis, or generic scraping.

What one repository check does

For each public owner/name, the Actor reads only fixed official GitHub REST paths:

• repository metadata;
• the configured newest release window; and
• the configured newest repository security-advisory window.

The Actor projects bounded factual fields, sorts them canonically, stores an exact canonical JSON evidence artifact, and emits baseline_created, unchanged, or changed. Change events distinguish repository metadata, added/updated/window-removed releases, and added/updated/withdrawn/window-removed advisories. A removal is never claimed when either compared window is truncated.

Input

{
  "repositories": [{"owner": "psf", "name": "requests"}],
  "baselineStoreId": "optional-persistent-kv-store-id",
  "includePrereleases": true,
  "includeDrafts": false,
  "releaseLimit": 100,
  "advisoryLimit": 100,
  "concurrency": 5
}

Inputs are capped at 100 unique repositories. Arbitrary URLs are rejected. Public checks need no secret. An optional GITHUB_TOKEN Actor environment secret can raise GitHub rate limits; it is never accepted in Actor input, echoed, or stored.

Output and deterministic evidence

The default dataset contains one result per requested repository plus one uncharged run summary. A chargeable result points to an EVIDENCE_*.json key-value-store record and includes its exact byte length and SHA-256. ARTIFACT_MANIFEST.json inventories successfully charged evidence artifacts. Snapshot bytes exclude run IDs, timestamps, and response headers, so identical source projections produce identical bytes and hashes.

With baselineStoreId, the Actor journals a candidate before output, emits the evidence artifact, then uses Apify's charged dataset push. The baseline becomes current only after that durable charged output reports one charged event. Recovery completes a charged-but-not-yet-committed journal on a later run.

Billing

The pay-per-event event is repository-check at the portfolio-planned price of $0.03 per terminal repository check. Only baseline_created, unchanged, and changed are chargeable. Invalid input, source/rate-limit/authorization errors, artifact or baseline failures, and charge-limit placeholders are uncharged. The Actor asks the charging manager for the available event count before scheduling work and never intentionally starts more checks than that budget admits.

Limits and interpretation

• GitHub is the sole source; an absent advisory is not evidence that no vulnerability exists elsewhere.
• Release and advisory windows are newest-first and capped at 500 each. Truncation is explicit.
• GitHub fields are publisher-maintained. AP-026 does not independently verify release contents, CVEs, severity, affected ranges, or patches.
• Draft visibility depends on caller authorization; unauthenticated public checks normally return only public records.
• Repository updated_at and pushed_at are tracked as factual metadata and may produce metadata-only changes.

See SOURCE_POLICY.md, PRIVACY.md, and THREAT_MODEL.md for operational boundaries.

Local verification

From the repository root, with the repository development environment active:

python -m pytest -q actors/ap-026-software-release-advisory-ledger/tests
python -m mypy --strict actors/ap-026-software-release-advisory-ledger/src
python -m ruff format --check actors/ap-026-software-release-advisory-ledger
python -m ruff check actors/ap-026-software-release-advisory-ledger
python -m bandit -q -r actors/ap-026-software-release-advisory-ledger/src
python actors/ap-026-software-release-advisory-ledger/tests/live_probe.py

No upload, paid hosted run, or publication is performed by these commands.