Zayin/Signage
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 4 Wiki Activity

ci: separate manual Signage release publishing #16

Merged
Zayin_Admin merged 1 commits from fix/manual-release-workflow into main 2026-10-11 03:59:22 +00:00
Conversation 1 Commits 1 Files Changed 5
+337 -119
ekklesia-bot commented 2026-10-11 03:50:39 +00:00
Member
Copy Link
Copy Source

Summary

  • keep normal PR/main CI limited to canonical package construction, verification, artifact transfer, and external-package integration
  • remove tag triggers, release write permission, corresponding-source publication work, and Gitea release mutation from normal CI
  • add a separate Publish Signage Release workflow that is workflow_dispatch only and requires an explicit version
  • require the operator-selected ref to be main, matching Core's manual package publisher
  • build the canonical Module Package once in a read-only release gate and run full external-package integration against those exact bytes
  • generate and verify ADR 0055 corresponding-source and redistribution assets before handing the proven six-file bundle to a separate write-authorized job
  • create or safely resume v<version> only after all gates pass, refuse conflicting tags/releases/assets, and anonymously read every uploaded asset back byte-for-byte
  • add static checks proving pull requests and pushes can never publish

Verification

  • bash ci/check-cleanup.sh (26 checks passed)
  • python3 -m unittest -v ci/test_release_assets.py (5 passed)
  • shell syntax, Python compilation, and git diff --check
  • pnpm lint
  • pnpm typecheck
  • pnpm test (22 files, 262 tests)
  • pnpm build
  • pnpm validate (20 checks)
  • canonical package verification at commit 86121d793102a1f7f83fca190040551b452f4cf6: 9,240,197 bytes, SHA-256 29b1cfcd3e169d47b30f05b2010c75b7a598096b6d89ed3dccd0b742133d4954
  • full external-package integration against those bytes, including UI/API/display browsers, resilience, process restart, container recreation, lifecycle, exact-package reinstall, retained data/history, TLS, and Doctor
  • corresponding-source acquisition/build/verification and exact six-file release-bundle validation

No tag or real release was created or modified during this work.

## Summary - keep normal PR/main CI limited to canonical package construction, verification, artifact transfer, and external-package integration - remove tag triggers, release write permission, corresponding-source publication work, and Gitea release mutation from normal CI - add a separate `Publish Signage Release` workflow that is `workflow_dispatch` only and requires an explicit version - require the operator-selected ref to be `main`, matching Core's manual package publisher - build the canonical Module Package once in a read-only release gate and run full external-package integration against those exact bytes - generate and verify ADR 0055 corresponding-source and redistribution assets before handing the proven six-file bundle to a separate write-authorized job - create or safely resume `v<version>` only after all gates pass, refuse conflicting tags/releases/assets, and anonymously read every uploaded asset back byte-for-byte - add static checks proving pull requests and pushes can never publish ## Verification - `bash ci/check-cleanup.sh` (26 checks passed) - `python3 -m unittest -v ci/test_release_assets.py` (5 passed) - shell syntax, Python compilation, and `git diff --check` - `pnpm lint` - `pnpm typecheck` - `pnpm test` (22 files, 262 tests) - `pnpm build` - `pnpm validate` (20 checks) - canonical package verification at commit `86121d793102a1f7f83fca190040551b452f4cf6`: 9,240,197 bytes, SHA-256 `29b1cfcd3e169d47b30f05b2010c75b7a598096b6d89ed3dccd0b742133d4954` - full external-package integration against those bytes, including UI/API/display browsers, resilience, process restart, container recreation, lifecycle, exact-package reinstall, retained data/history, TLS, and Doctor - corresponding-source acquisition/build/verification and exact six-file release-bundle validation No tag or real release was created or modified during this work.
ekklesia-bot added 1 commit 2026-10-11 03:50:39 +00:00
ci: separate manual release publishing
CI / lint (pull_request) Successful in 12s
Details
CI / typecheck (pull_request) Successful in 10s
Details
CI / test (pull_request) Successful in 17s
Details
CI / build (pull_request) Successful in 11s
Details
CI / package (pull_request) Successful in 13s
Details
CI / integration (pull_request) Successful in 7m19s
Details
86121d7931
Zayin_Admin merged commit 91bdba3136 into main 2026-10-11 03:59:22 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Zayin_Admin
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Joey Zayin_Admin ekklesia-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Zayin/Signage#16