audit-labs/audit-report

Turn audit-tools evidence packages into control-mapped, auditor-ready reports.

clone: git clone https://gitbay.org/audit-labs/audit-report.git

073020727e5ddc574f63690de8e559a5e43d2794

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-08-08T03:52:44Z

Release v1.0.0

Bump version to 1.0.0, add CHANGELOG, and document the stability commitment.

 CHANGELOG.md             | 28 ++++++++++++++++++++++++++++
 README.md                |  8 ++++++++
 audit_report/__init__.py |  2 +-
 pyproject.toml           |  2 +-
 4 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..7306e7e
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres
+to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-08-07
+
+First stable release. The JSON report schema — findings carrying their `controls`
+and `pass` / `fail` / `not_applicable` status — is now a committed contract that
+[control-coverage](https://github.com/audit-labs/control-coverage) consumes
+directly; it will not change in a breaking way without a major-version bump.
+
+## [0.1.0] - 2026-08-06
+
+### Added
+
+- Control-mapped reports from an audit-tools evidence package: declarative YAML
+  rulesets map pass/fail results to SOC 2, ISO 27001, and NIST SP 800-53 controls.
+- Output as Markdown, self-contained HTML, or JSON; `--fail-on {low,medium,high,none}`
+  gate for CI.
+- Bundled rulesets for GitHub, GitLab, and AWS evidence.
+- Trend mode to diff two evidence packages.
+- Tool and ruleset provenance stamped into every report.
+- PyPI trusted-publishing release workflow.
+
+[1.0.0]: https://github.com/audit-labs/audit-report/releases/tag/v1.0.0
+[0.1.0]: https://github.com/audit-labs/audit-report/releases/tag/v0.1.0
diff --git a/README.md b/README.md
index 4f208f3..35ae487 100644
--- a/README.md
+++ b/README.md
@@ -167,6 +167,14 @@ The `--fail-on` exit code (`1` = a finding/regression met the threshold, `2` =
 usage error) lets a workflow separate "the audit found a problem" from "the job
 is misconfigured".
 
+## Stability
+
+`audit-report` is stable as of **v1.0.0** and follows [semantic versioning](https://semver.org).
+The JSON report schema — findings carrying their `controls` and
+`pass` / `fail` / `not_applicable` status — is a committed contract that
+[control-coverage](https://github.com/audit-labs/control-coverage) consumes
+directly; it will not break without a major-version bump.
+
 ## Development
 
 ```bash
diff --git a/audit_report/__init__.py b/audit_report/__init__.py
index 9da2eb6..42196ec 100644
--- a/audit_report/__init__.py
+++ b/audit_report/__init__.py
@@ -1,3 +1,3 @@
 """audit-report — turn audit-tools evidence packages into control-mapped reports."""
 
-__version__ = "0.1.0"
+__version__ = "1.0.0"
diff --git a/pyproject.toml b/pyproject.toml
index ec04947..ee68a2e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "audit-report"
-version = "0.1.0"
+version = "1.0.0"
 description = "Turn audit-tools evidence packages into control-mapped, auditor-ready reports."
 readme = "README.md"
 requires-python = ">=3.10"