From fd73cd0662becbf9efb3223e08617ed8fa8f8aea Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Mon, 2 Nov 2026 14:04:42 +0000 Subject: [PATCH] Adopt ReleaseKit v0.7.0 and update recovery guidance --- docs/release.md | 13 +++++++++++-- go.mod | 2 +- go.sum | 4 ++-- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/docs/release.md b/docs/release.md index 00d5114..7dfd8d2 100644 --- a/docs/release.md +++ b/docs/release.md @@ -74,7 +74,7 @@ For an optional local diagnostic of a committed candidate, run: ``` This is not a required step before publication. The upstream -[candidate-check contract](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.6.0/docs/consumers/check.md) +[candidate-check contract](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/consumers/check.md) describes its requirements. Run the single publication command with the chosen version: @@ -104,12 +104,21 @@ known publication conflict. Correct and commit candidate defects, push `main`, and rerun publication with an unused version when appropriate. Status 2 means the invocation or profile must be corrected. +If local tag creation or verification fails, inspect the reported local ref: +it may remain even when ReleaseKit could not establish its object ID. Apply +the authoritative-state checks below before removing a retained tag. + For status 3, do not retry or remove the local tag until the remote outcome is resolved. ReleaseKit reports the attempted version, tag object, and recovery state, including the captured publication endpoint when available. Use that endpoint—not merely the current `origin` URL—to query the exact tag; follow the upstream -[failure-recovery procedure](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.6.0/docs/release.md#resolve-failures): +[failure-recovery procedure](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/release.md#resolve-failures). + +CLI diagnostics mask HTTP(S) credentials. If the displayed endpoint is +redacted, use the actual endpoint captured for that attempt, with authentication +supplied locally; do not copy the redacted display as a transport URL or expose +credentials in shared logs. ```sh releasekit_endpoint='COPY_CAPTURED_ENDPOINT' diff --git a/go.mod b/go.mod index 43618b2..bb5ac8f 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ require ( require ( github.com/yuin/goldmark/v2 v2.1.6 // indirect - go.maximumdirect.net/releasekit v0.6.0 // indirect + go.maximumdirect.net/releasekit v0.7.0 // indirect go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect golang.org/x/mod v0.40.0 // indirect golang.org/x/text v0.14.0 // indirect diff --git a/go.sum b/go.sum index 6e60af7..d0e8acd 100644 --- a/go.sum +++ b/go.sum @@ -6,8 +6,8 @@ github.com/yuin/goldmark/v2 v2.1.6 h1:igy0q9JcqovoFXFx/XjtU8sHVhcUHavPj2sA3EoKJU github.com/yuin/goldmark/v2 v2.1.6/go.mod h1:G6M4/qOFtfn01/o14BU1UR2Lo5N3S9Qo7xCuz/sHjGQ= go.maximumdirect.net/configkit v1.0.0 h1:cguQnxkaRk3ClQOZNzzhTdc4bfzbraGKv8CkoCp+HLc= go.maximumdirect.net/configkit v1.0.0/go.mod h1:B6fJ5xBLBF1nuywqfLeEI4sLm29UkIcDLu8i6I6gGXE= -go.maximumdirect.net/releasekit v0.6.0 h1:wbzMeQGeLjXigBSN9j9iJLf/CC3htjzt9iEwubezgy0= -go.maximumdirect.net/releasekit v0.6.0/go.mod h1:QE4BLrAhVJTzi+/YTcVl21K/qZp9ojRLg5kuoy3Zb44= +go.maximumdirect.net/releasekit v0.7.0 h1:iQED4D/nfNbO8fO7ItQtIqQp1xZ5EUHKRIUmP+trix0= +go.maximumdirect.net/releasekit v0.7.0/go.mod h1:QE4BLrAhVJTzi+/YTcVl21K/qZp9ojRLg5kuoy3Zb44= go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4= go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=