Windows 11 Release Guard

Windows release policy guard for broad-fleet Windows 11 version checks.

Windows 11 Release Guard tells administrators whether an existing Windows 11 device is on the current fleet release and quality baseline, using a signed JSON feed, build-first local evidence, a static GitHub Pages dashboard/API, and a PyPI package for sysadmin/RMM automation. The repository, distribution package, installed console command, and Python import package use the same win11_release_guard name.

[!IMPORTANT] Compliance trust comes from the signed public policy JSON plus detached signature, not from display labels or badge state. Start with Policy Feed and Trust Model and Local Windows Detection.

What This Does

• Checks Windows 11 release/build/baseline compliance from a signed public JSON release policy feed.
• Uses build-first local evidence; ProductName, WMI Caption, and DisplayVersion stay diagnostic.
• Keeps Windows Update Agent data optional and secondary; WUA diagnostics never override the policy verdict.
• Compacts local Panther/setup log tails in JSON by default, with fixed-path tail-bounded reads and a raw opt-in for troubleshooting.
• Shows Source Diagnostics and workflow-only GitHub Issue links on the dashboard as troubleshooting signals, never fleet verdict authority.
• Shows a dashboard-only baseline-update notice when a real Release Health B-release baseline catches up to the latest observed Microsoft build.
• Treats existing devices as targeting 25H2 while 26H1 remains excluded for existing-device targeting.
• Emits human, JSON, and JSON-pretty output with stable exit codes for RMM/fleet checks.
• Publishes a static GitHub Pages dashboard, Pages Wiki, and /api/v1 policy, signature, and manifest aliases.

See Architecture, Local Windows Detection, and Source Diagnostics for the detail behind each point.

Quick Start

Install the released package:

python -m pip install win11_release_guard
win11_release_guard --pretty
win11_release_guard --json-pretty --no-wua
win11_release_guard --json-pretty --include-raw-local-diagnostics

Production compliance jobs normally use:

win11_release_guard --strict-production --json-pretty --no-wua

[!TIP] RMM jobs normally want stable JSON and exit codes first; keep WUA as secondary read-only context unless you explicitly need local update-offer evidence. See CLI and RMM Usage.

Deep dive: Quick Start, CLI and RMM Usage, Configuration.

Public Feed And Dashboard

/api/v1 mirrors these as stable aliases, kept backward compatible — with signing-key overlap — for at least 24 months. GitHub Pages is static, so feed freshness is recomputed from generated timestamps in the browser and CLI rather than trusted from render time.

[!NOTE] Policy Feed Currency is the latest compilation timestamp for the parsed policy results. If it looks old, check the publish-policy workflow and the Anti-Static Freshness notes.

Deep dive: GitHub Pages Dashboard, Policy Feed and Trust Model, dashboard docs.

Support The Project

If Windows 11 Release Guard saves you time or helps your fleet checks, please star the repository. Stars make the project easier for other Windows administrators to discover and help justify continued testing, documentation, release automation, and dashboard work.

Common User Paths

Core Concepts

Maintainer Commands

python -m compileall -q win11_release_guard tools tests
python tools/check_project_identity.py
python tools/check_version_consistency.py
python tools/check_github_action_versions.py
PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest -q
python tools/scan_for_secret_material.py README.md CHANGELOG.md AGENTS.md docs wiki win11_release_guard tests tools pyproject.toml .github
python -m win11_release_guard --check-policy-source
python -m win11_release_guard --check-public-pages
python -m build
python -m twine check dist/*
python tools/export_clean_archive.py --output dist/win11_release_guard-source.zip
python tools/export_clean_archive.py --validate dist/win11_release_guard-source.zip

Deployment-affecting changes require the live Pages gate before handover. Use the full gate in AGENTS.md and Build, Test and Release when changing workflows, the policy generator, signing, Pages, manifest/API aliases, source URLs, or public-check CLI behavior.

Safety And Trust Model

• Runtime clients fetch public JSON plus .sig. Runtime clients do not authenticate to GitHub and do not need GitHub tokens, private repository access, or a paid signing certificate. The private signing key lives only in a GitHub Actions secret; public verification keys are committed.
• The production generator may use public Microsoft Release Health HTML, the public Microsoft servicing table-of-contents JSON, public Microsoft servicing support articles, and unauthenticated public MSRC CVRF data for source diagnostics and informational enrichment; it does not use Microsoft Graph or token-authenticated Microsoft APIs. Enrichment links and article facts are revalidated before they can affect a summary or a security label.
• Source Diagnostics issue sync and PyPI publishing both run from GitHub Actions with built-in, minimally scoped tokens; neither stores a PAT or API credential.
• GitHub scheduled workflows are best-effort automation, not guaranteed cron. Badge status is a useful signal, not an operational proof.
• Dependency freshness is checked by a scheduled workflow. Dependency freshness is a scheduled direct-dependency check over direct dependency specifiers; it is not an always-current dependency guarantee. The Pylint badge reports the workflow for the current --fail-under=8.0 gate, not a permanent quality certificate.

[!WARNING] Source Diagnostics explain parser/source health and can block publishing on generator error events, but they never override the signed runtime verdict. Review Source Diagnostics before treating a warning as fleet compliance evidence.

Deep dive: Policy Feed and Trust Model, security automation.

Documentation Map

The generated Pages Wiki is the primary public, indexed documentation surface. The GitHub internal Wiki is a Markdown-compatible mirror of the same wiki/*.md source, synced by .github/workflows/sync-wiki.yml. The first-party Python renderer escapes raw HTML and adds no external JS, CSS, fonts, or CDN dependencies.

CHANGELOG.md remains the manually maintained changelog source of truth. Newer entries are added at the top; older version sections remain visible in the generated Pages changelog.

Contribution, Support, License

• Issues: https://github.com/Avnsx/win11_release_guard/issues
• Releases: https://github.com/Avnsx/win11_release_guard/releases
• Changelog: CHANGELOG.md
• License: GPL-3.0-only, see LICENSE.txt

Do not commit GitHub tokens, private signing keys, generated site/, generated dist/, .tmp/, dependency-freshness.json, package metadata folders, pycache, raw worktree archives, or private key scratch files.

This project is independent open-source software and is not affiliated with Microsoft.