Repository navigation
✨ feat: extensionrepo: prove releases with a receipt - #400
Merged
Merged
Conversation
Require the pushed SHA and its successful signoff receipt before tagging Replay the published README install, compare its SHA, measure Economy, and prove uninstall in scratch folders Keep release evidence in the cache and test publication through local bare remotes
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
|
- Purpose: keep the release proof within the repository file limit - Impact: move shared calls and receipt fixtures without behavior changes
- Purpose: measure extension examples with their tagged input files - Impact: extract archive files for each call and replace the named input with a supplied fixture - Proof: reproduce missing-input rows and fixture name mismatches before the fix
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An extension release could pass after its README installed the previous tag. The release also lacked evidence tied to its signed SHA.
Implement COR-103-T10 through
just release vX.Y.Z [fixture]. Require the signed, pushed SHA and acceptance before publication. Replay the README against the published remote, compare its clone SHA, measure Economy, and prove uninstall withNOT_FOUND. Store evidence in the cache and the signoff receipt in the annotated tag.Proved by:
uv run --no-project --python 3.12 just check(exit 0), plus D095 and Economy red/green controlsjust checkpassesjust releaseis a repository task, and no verify-nicely feature drives it. Independent proof instead: Sol reranuv run --no-project --python 3.12 just templateat86e473f2, with local bare remotes and a stubgh("Both layouts pass all four default Economy calls; the differently named fixture replaces the example input correctly"). The first real use is the video-convert release of COR-103-T14nicelyfor corejust signoffpasses, orjust signoff-layersfor a stackStep 4 is n/a for catalog entries. Repository-task diagnostics follow the existing signoff program.
For step 7, the template AGENTS release section teaches the recipe. The README install block already uses
TAG, and no ncly command changes.All test releases use local bare remotes and stub
gh. Independent verification and signoff belong to the root.Review fixes: Economy gives each example its input files from the tagged clone's
testdata/examples.txtar, and a supplied fixture replaces the example's input file, so the default release measures a real dry run and run instead of a missing-input error (Sol S1). The default release test now requires exit 0 for those rows.Root review: Opus 5.5 read the full diff and the fix.
Reviewed with sol-loop: 2 rounds with gpt-6.1-sol on xhigh. Sol verdict: approved
by GPT-6.1-Sol via Codex