cyberaar.hardening

What is costing points

Each of these is a signal we observed and could not fully credit.

• quality.changelog

  Ship a `changelogs/changelog.yaml` — the structured form `antsibull-changelog` generates and the `ansible` package consumes — rather than only a hand-maintained `CHANGELOG.md`, and write a fragment into `changelogs/fragments/` as each change lands rather than reconstructing release notes at release time. Both have to be inside the published tarball to be observable: a changelog that lives only in your Git repository is one we cannot read. This is the single highest-leverage change for most collections, because the same missing file is what holds down both changelog rules in this rubric. If you already publish `changelog.yaml` with fragments, this rule is answered.

• compat.requires_ansible

  Declare a `requires_ansible` FLOOR in your `galaxy.yml` naming the oldest ansible-core you actually support, and declare an upper bound alongside it if you test against one — the bound is credited on top of whichever floor tier you reach in the table beside this rule. Declaring nothing now scores zero and STAYS in your score rather than dropping out of it, so omitting the field is no longer a way to avoid the question; if your score fell and you have never declared a floor, this is why. An exact pin or a `~=` compatible-release specifier earns only a small share, strictly below every floor tier: it is a real declaration we could read, so it beats silence, and it sits at the bottom because pinning ansible-core is the practice this category exists to discourage. Raising a floor you cannot actually support would be a false declaration, and this rule is not worth that.