version: 1
rules:
  require_primary_source: true
  require_version_applicability: true
  require_reproducible_evidence: true
  require_corroboration_for_major_change: true
  reject_unsourced_claims: true
  automatic_apply: false
# El contexto de la empresa no es una fuente de la profesión: vive en
# organization/roles/release-manager.md dentro de cada instalación.
sources:
  - name: DORA continuous delivery
    url: https://dora.dev/capabilities/continuous-delivery/
    tier: profession
    topics: [continuous-delivery, testing, security, observability, outcomes]
  - name: DORA deployment automation
    url: https://dora.dev/capabilities/deployment-automation/
    tier: profession
    topics: [automation, artifacts, configuration, repeatability, audit]
  - name: Google SRE Release Engineering
    url: https://sre.google/sre-book/release-engineering/
    tier: profession
    topics: [build, release, canary, rollout, rollback, configuration]
  - name: SLSA specification version 1.2
    url: https://slsa.dev/spec/v1.2/
    tier: standard
    topics: [software-supply-chain, provenance, source, build, attestations]