mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
4674750b7e
## Summary Redesign the permanent Desktop release flow so unrelated merges to `main` cannot invalidate an already reviewed, green release candidate. - Tag the immutable, API-confirmed release PR head instead of its later squash commit. - Treat the merged PR—including an authorized owner/admin bypass—as publication authorization, while requiring trusted check evidence that was complete at merge time. - Make tag creation idempotent and collision-safe: an existing tag succeeds only at the exact candidate SHA, and create races refetch before accepting equality. - Replace ancestry-based previous-release discovery with a validated metadata ledger for side-history candidate tags. - Compute the next release from the prior frozen base to the new frozen base, excluding only the prior release squash SHA so unrelated commits remain in the changelog. - Preserve schema-1 production-tag migration and reject malformed metadata or equal/decreasing versions. - Update operator documentation for the normal squash-merge workflow. This is the reusable release process for `0.5.6` onward, not the retired one-shot `0.5.5` recovery path. ### Invariants covered - Candidate creation → unrelated `main` merge → authorized squash merge → immutable candidate tag. - Trusted producer IDs and merge-time completion timestamps; DCO's bounded post-merge exception remains isolated. - Missing/spoofed checks, tampered candidates, ambiguous PR associations, conflicting tags, and equal/decreasing versions fail closed. - Same-SHA retries succeed; different-SHA collisions fail. - Legacy schema-1 tag-on-main migration and schema-2 side-history accounting both preserve the correct next-release changelog. ### Related issue N/A — follows the Desktop release failures in #4788 and #4800 and the recovery revert in #4808. ### Testing At clean commit `6a91fbed8147a48cf174997de0c3e4cb2fb26474`: - `scripts/test-desktop-release-candidate.sh` - `scripts/test-release-ref-contract.sh` Both focused suites passed with HEAD unchanged. Princess Donut cleared the security/provenance surface, including the hostile merge-time timestamp cases. Mongo cleared the side-history ledger, migration, version-order, documentation, and contract-test surface. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
26 lines
825 B
Plaintext
26 lines
825 B
Plaintext
# REST check runs do not expose per-attempt creation time. The endpoint is
|
|
# intentionally queried with filter=latest; select the highest immutable run ID
|
|
# for the trusted producer and require that returned attempt to have completed
|
|
# successfully by merge. Any ordinary post-merge rerun therefore fails closed
|
|
# and needs operator inspection. DCO alone has a bounded five-minute exception.
|
|
[
|
|
.[].check_runs[]
|
|
| select(.name == $name and .app.id == $integration_id)
|
|
]
|
|
| sort_by(.id)
|
|
| last
|
|
| select((.completed_at // null) != null)
|
|
| select(
|
|
(.completed_at | fromdateiso8601)
|
|
<= (
|
|
($merged_at | fromdateiso8601)
|
|
+ (if $name == "DCO Check" then 300 else 0 end)
|
|
)
|
|
)
|
|
| .status == "completed"
|
|
and (
|
|
.conclusion == "success"
|
|
or .conclusion == "skipped"
|
|
or .conclusion == "neutral"
|
|
)
|