Merge pull request #28 from TacoRocket/release-v1.0.0

Prepare AzureFox v1.0.0 release

Author: TacoRocket

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @TacoRocket

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/Chicago"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/Chicago"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "deps"

.github/workflows/release.yml

@@ -0,0 +1,112 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Build dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+
+      - name: Build artifacts
+        run: python -m build
+
+      - name: Smoke-test built wheel
+        run: |
+          set -euo pipefail
+          wheel=(dist/*.whl)
+          if [ "${#wheel[@]}" -ne 1 ]; then
+            echo "Expected exactly one wheel artifact in dist/" >&2
+            exit 1
+          fi
+
+          python -m venv /tmp/azurefox-release-smoke-venv
+          /tmp/azurefox-release-smoke-venv/bin/pip install "${wheel[0]}"
+          /tmp/azurefox-release-smoke-venv/bin/azurefox help >/dev/null
+          AZUREFOX_FIXTURE_DIR=tests/fixtures/lab_tenant \
+            /tmp/azurefox-release-smoke-venv/bin/azurefox \
+            --outdir /tmp/azurefox-release-smoke \
+            --output json \
+            whoami \
+            >/dev/null
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-dist
+          path: dist/*
+          if-no-files-found: error
+
+  github-release:
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: write
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: release-dist
+          path: dist
+
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          assets=(dist/*)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release assets found in dist/" >&2
+            exit 1
+          fi
+
+          if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
+            gh release upload "${GITHUB_REF_NAME}" "${assets[@]}" --clobber
+          else
+            gh release create "${GITHUB_REF_NAME}" "${assets[@]}" \
+              --generate-notes \
+              --title "${GITHUB_REF_NAME}" \
+              --verify-tag
+          fi
+
+  pypi-publish:
+    runs-on: ubuntu-latest
+    needs: build
+    environment:
+      name: pypi
+    permissions:
+      id-token: write
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: release-dist
+          path: dist
+
+      - name: Publish to PyPI via Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

CHANGELOG.md

@@ -1,10 +1,24 @@
 # Changelog
 
-## [0.1.0] - 2026-03-10
+## [1.0.0] - 2026-04-02
 
 ### Added
-- Initial AzureFox scaffold with Milestone 1 command surface.
-- Shared auth/session, client factory, collectors, correlation layer, and output writers.
-- JSON schema snapshots, fixture dataset, golden output snapshots.
-- CI workflow for lint + unit/contract/smoke checks.
+- AzureFox Phase 1 through Phase 3 command surface, including identity, privilege, secrets,
+  config, storage, compute, app, API, DNS, and network-oriented recon commands.
+- Operator-first grouped orchestration with `all-checks` plus per-section execution.
+- API-mapping and feature-complete reference docs that define the current evidence boundary.
+- Release workflow for GitHub Releases plus PyPI Trusted Publishing.
 
+### Changed
+- Hardened truthfulness across trust, workload, endpoint, and storage outputs so commands do not
+  imply stronger proof than the current read path supports.
+- Improved `all-checks` help and README guidance to set longer-runtime expectations clearly.
+- Tightened release packaging metadata and install guidance for the public `azure` dependency
+  profile.
+
+### Fixed
+- Normalized ARM ID joins used by `network-ports`, `workloads`, and related endpoint correlation
+  so live joins stay stable across casing differences.
+- Corrected the Azure extras packaging constraint for `azure-mgmt-sql` so fresh
+  `pip install -e '.[azure]'` installs succeed on the stable package index.
+- Added CI gitleaks scanning and tokenless Trusted Publishing workflow support.

README.md

@@ -5,6 +5,8 @@
 </p>
 
 AzureFox is a Python CLI for offensive-focused Azure situational awareness.
+It is designed to help operators and testers quickly build a truthful picture of Azure identity,
+resource, network, secrets, and workload attack surface from management-plane read paths.
 
 ## Attribution
 
@@ -51,22 +53,30 @@ Fox.
 ```bash
 python -m venv .venv
 source .venv/bin/activate
-pip install -e '.[azure]'
+pip install 'azurefox[azure]'
 azurefox --outdir /tmp/azurefox-demo whoami --output table
 azurefox --outdir /tmp/azurefox-demo all-checks --output table
 ```
 
+For local source-based development, use `pip install -e '.[dev,azure]'`.
+
 ## Install Profiles
 
 AzureFox keeps a small core package and uses extras for live Azure collection and contributor
 tooling.
 
+- `pip install azurefox`
+  installs the core CLI from PyPI without live Azure SDK dependencies; this is mostly useful for
+  help output, packaging work, or fixture-based local development
 - `pip install -e .`
   installs the core CLI only; this is mostly useful for help output, packaging work, or
   fixture-based local development
+- `pip install 'azurefox[azure]'`
+  installs the published AzureFox package plus the Azure SDK dependencies required for live Azure
+  command execution; most operators should use this profile
 - `pip install -e '.[azure]'`
   installs the Azure SDK dependencies required for live Azure command execution; most operators
-  should use this profile
+  should use this profile when working from a local checkout
 - `pip install -e '.[dev]'`
   installs lint, test, and type-check tooling for contributors working without live Azure SDK
   dependencies

SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+## Supported Versions
+
+AzureFox is currently maintained on the latest release line.
+
+| Version | Supported |
+| --- | --- |
+| 1.x | Yes |
+| < 1.0.0 | No |
+
+## Reporting A Vulnerability
+
+Please do not open public GitHub issues for suspected security vulnerabilities.
+
+Preferred path:
+
+- use GitHub private vulnerability reporting or a private security advisory if it is available
+
+If private reporting is not available, contact the maintainer directly through GitHub rather than
+posting a public issue with exploit details.
+
+When reporting, please include:
+
+- affected version
+- reproduction steps
+- impact and scope
+- any suggested remediation or mitigation
+
+## Scope Notes
+
+AzureFox intentionally enumerates risky cloud posture and attack-surface signals. Reports that a
+fixture, lab artifact, or intentionally documented proof environment contains insecure-by-design
+test posture are generally not treated as product vulnerabilities by themselves.
+
+Useful security reports usually involve one of these:
+
+- accidental credential exposure in the repo or release artifacts
+- supply-chain or release-process weaknesses
+- output that overstates proof in a way that could mislead operators materially
+- code execution, unsafe file handling, or similar implementation flaws in AzureFox itself

docs/release-process.md

@@ -37,4 +37,10 @@ Use semantic versioning (`MAJOR.MINOR.PATCH`).
    git tag v<version>
    git push origin v<version>
    ```
-8. Publish package artifact once the registry target is selected.
+8. Let `.github/workflows/release.yml` publish the built artifacts:
+   - to GitHub Releases with the tag name as the release title
+   - to PyPI via Trusted Publishing from the `pypi` GitHub Actions environment
+9. Keep PyPI publishing tokenless:
+   - configure the PyPI trusted publisher for owner `TacoRocket`, repo `AzureFox`,
+     workflow `release.yml`, and environment `pypi`
+   - add protection rules to the `pypi` GitHub environment so publish approval stays explicit

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "azurefox"
-version = "0.1.0"
+version = "1.0.0"
 description = "AzureFox - offensive-focused Azure situational awareness CLI"
 readme = "README.md"
 requires-python = ">=3.11"

src/azurefox/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.1.0"
+__version__ = "1.0.0"