From 818470ae14da6fdaec3e9c6d6ea87b00c183e5a6 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Wed, 9 Sep 2026 16:18:36 +0800
Subject: [PATCH] Enforce numeric semantic version tags

---
 README.md                   |  6 ++++++
 docs/REPOSITORY_STANDARD.md | 11 +++++++++++
 standards/repository.yml    | 12 ++++++++++++
 3 files changed, 29 insertions(+)

diff --git a/README.md b/README.md
index 7b7a338..635f944 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,12 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 - A machine-readable [repository policy](standards/repository.yml) for future automation.
 - Optional workflow templates for migration integrity and Go module projects.
 
+New PastureStack release and image versions use only numeric semantic versions
+(`vMAJOR.MINOR.PATCH` or `MAJOR.MINOR.PATCH`). Brand, platform, candidate, and
+maintenance text belongs in package names and provenance metadata, not in a
+new version tag. Existing published tags remain immutable historical records;
+see the [release standard](docs/REPOSITORY_STANDARD.md#7-releases-and-packages).
+
 GitHub applies supported community health files from this repository only when a target repository does not provide its own file of the same type. Repository-specific guidance always takes precedence.
 
 ## Important limitations
diff --git a/docs/REPOSITORY_STANDARD.md b/docs/REPOSITORY_STANDARD.md
index c18c7ea..0f6f6da 100644
--- a/docs/REPOSITORY_STANDARD.md
+++ b/docs/REPOSITORY_STANDARD.md
@@ -90,6 +90,17 @@ Required for maintained releases:
 - identify the source commit and build inputs;
 - publish checksums for downloadable artifacts;
 - document image names, tags, and digests;
+- use only `vMAJOR.MINOR.PATCH` or `MAJOR.MINOR.PATCH` for every new
+  PastureStack-owned Git tag, GitHub Release, package version, and image tag;
+- reject brand, platform, candidate, rebuild, branch, or maintenance text in a
+  new version (for example `-pasturestack.N`, `-windows-*`, or `-rcN`);
+- express platform differences through distinct package or image names, and
+  record source boundaries and rebuild metadata in OCI labels, SBOM,
+  attestations, commits, and release notes instead of the version string;
+- preserve every existing published tag as immutable history rather than
+  deleting, moving, or reusing it;
+- enforce the `Require numeric semantic version tags` GitHub tag ruleset on
+  version-like tags (`v*` and digit-prefixed tags), without a bypass actor;
 - avoid reusing upstream release tags for rebuilt artifacts; and
 - publish compatibility and upgrade notes.
 
diff --git a/standards/repository.yml b/standards/repository.yml
index 2d8ec84..d7ada1d 100644
--- a/standards/repository.yml
+++ b/standards/repository.yml
@@ -51,6 +51,18 @@ public_default_branch_rules:
   required_checks: add-after-check-names-stabilize
 
 release:
+  version_format: numeric-semver
+  optional_v_prefix: true
+  text_qualifiers_allowed: false
+  preserve_published_tags: true
+  tag_ruleset:
+    name: Require numeric semantic version tags
+    enforcement: active
+    bypass_allowed: false
+    include:
+      - refs/tags/v*
+      - refs/tags/[0-9]*
+    regex: '^v?[0-9]+\.[0-9]+\.[0-9]+$'
   reuse_upstream_tags_for_rebuilds: false
   checksums_required: true
   source_commit_required: true