Add v0 release metadata

[IlyaasK]

Summary

• Add CHANGELOG.md with the v0 release-candidate surface and explicit non-goals.
• Add .github/release.yml for GitHub generated release-note categorization.
• Add SECURITY.md with a pre-v0 reporting policy and a public-release gate for vulnerability reporting setup.
• Update release docs to require a license decision and vulnerability-reporting confirmation before a public v0 tag.

Why this is v0 work

v0 should be releasable without growing the provider feature surface. These files add minimal release metadata and make the remaining human-owned publication decisions explicit.

Intentionally unsupported in v0

• No release automation is added.
• No GoReleaser workflow is added.
• No license is selected in this PR because nearby Kernel repositories use different licenses; the release owner must make that decision before public publication.
• No v1 resources, force_destroy, codegen, or runtime/session Terraform operations are included.

Tests run

• ruby -e 'require "yaml"; YAML.load_file(".github/release.yml"); YAML.load_file(".github/workflows/acceptance.yml"); YAML.load_file(".github/workflows/ci.yml")'
• bash scripts/check-markdown-links.sh
• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-examples.sh
• bash scripts/check-docs.sh
• git diff --check hypeship/v0-acceptance-workflow
• git diff --cached --check

Acceptance-test status

Acceptance tests were not run for this metadata-only slice. They remain a manual release gate via the Acceptance workflow or the documented local command with credentials.

Review gates

• deslop: clean, no accepted findings.
• incremental self-pr review: clean; consciously did not add a LICENSE because the correct license is a release-owner decision.
• autoreview: clean, no accepted/actionable findings reported.
• dave-cheney-go-review: clean; metadata-only diff with no Go API, package, or test impact.
• eblog-code-review: clean; adds minimal release state and explicitly gates license/security ownership instead of introducing half-automation.
• final agreement pass: clean; metadata only, no release automation or provider behavior changes.

Deferred v1 issues

• Consider opt-in force_destroy for kernel_browser_pool (architecture amendment) #24 force_destroy for kernel_browser_pool.
• Generate Terraform Plugin Framework schema/model via tfplugingen-framework codegen #25 Terraform Plugin Framework code generation.

Remaining manual release gates

• Choose and add/confirm the repository license before public v0 publication.
• Enable GitHub private vulnerability reporting or document a public security contact in SECURITY.md.
• Run real browser-pool acceptance tests with credentials before tagging v0.
• Confirm signing/checksum ownership before publishing release artifacts.

---

Note

Low Risk
Documentation and GitHub release-note config only; no Go provider logic, credentials handling, or automation changes.

Overview
Adds release and security metadata for the Kernel Terraform provider without changing provider behavior or adding release automation.

New files: CHANGELOG.md documents the v0 release-candidate scope (provider config, kernel_browser_pool, lookup data sources, import, tests/CI) and explicit v0 non-goals; .github/release.yml maps PR labels to GitHub generated release-note categories; SECURITY.md defines pre-public reporting (Kernel disclosure program, email, optional GitHub private reporting) and notes v0 stays internal until a complete v1 public release.

docs/release.md is updated to state that v0 tags/registry artifacts stay internal, acceptance tests gate the first public release (not only v0), and release owners must confirm LICENSE and vulnerability reporting setup before any public tag.

^{Reviewed by Cursor Bugbot for commit 4300767. Bugbot is set up for automated code reviews on this repo. Configure here.}

[tnsardesai]

maybe we should link to security@kernel.sh (or is the email something else?)

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4300767. Configure here.}

[cursor]

Acceptance gate skips internal v0

Medium Severity

The checklist now requires acceptance tests only before the first public release. Since v0 releases are explicitly internal and the first public release is v1, this change inadvertently removes the explicit acceptance test requirement for internal v0 tags.

 

^{Reviewed by Cursor Bugbot for commit 4300767. Configure here.}