Adopt the updated release policy
This commit is contained in:
@@ -2,7 +2,11 @@
|
||||
|
||||
## Standard Repository Policies
|
||||
|
||||
Material: All documents under `docs/policy/`, root `AGENTS.md`, and the Policy Reading Guide in `docs/development.md`, adapted for this repository.
|
||||
Material: All documents under `docs/policy/`, root `AGENTS.md`, and the Policy
|
||||
Reading Guide in `docs/development.md`, adapted for this repository.
|
||||
`docs/policy/release.md` incorporates revision
|
||||
`e833faddf120c789a9b45348edaf75720de16348`; the remaining listed material
|
||||
incorporates revision `d84a38ebab26f048cafbe59a2246700c35d29843`.
|
||||
|
||||
Copyright (C) 2026 Eric Rakestraw
|
||||
|
||||
@@ -10,10 +14,14 @@ SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
|
||||
License and notices: [CC BY-SA 4.0](licenses/CC-BY-SA-4.0.txt) |
|
||||
[COPYRIGHT](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/COPYRIGHT) |
|
||||
[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/LICENSE).
|
||||
[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/LICENSE) |
|
||||
[COPYRIGHT](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/COPYRIGHT) |
|
||||
[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/LICENSE).
|
||||
|
||||
[Source](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843).
|
||||
|
||||
[Source](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348).
|
||||
|
||||
## ConfigKit
|
||||
|
||||
Selected module: `gitea.maximumdirect.net/eric/ConfigKit` at `v0.5.0`.
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
# Release Policy
|
||||
|
||||
**Base Policy Version:** 1.4
|
||||
**Base Policy Version:** 1.6
|
||||
|
||||
**Last Updated**: 2026-10-07
|
||||
**Upstream Source:** [Standard Repository Policies release](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/release.md)
|
||||
**Last Updated**: 2026-10-08
|
||||
**Upstream Source:** [Standard Repository Policies release](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/docs/policy/release.md)
|
||||
|
||||
## Purpose
|
||||
|
||||
@@ -11,6 +11,9 @@ This policy defines a proportionate workflow for validating and publishing an
|
||||
intended source revision under a fresh version. Releases should require little
|
||||
routine intervention, avoid repeated work, and preserve published contents.
|
||||
|
||||
Adopt stronger verification or reproducibility requirements through an explicit
|
||||
project-specific decision justified by the intended audience and support needs.
|
||||
|
||||
The repository-specific commands belong in `docs/release.md`. Historical release
|
||||
summaries belong in `docs/releases/`. The procedure must agree with the adopted
|
||||
policy and link to it rather than introduce additional release requirements.
|
||||
@@ -75,7 +78,8 @@ requires a deliberate update to the policy and procedure where needed.
|
||||
For releases at or after `v1.0.0`:
|
||||
|
||||
- a major release may make intentional incompatible changes;
|
||||
- a minor release may add backward-compatible behavior; and
|
||||
- a minor release may add backward-compatible behavior or raise the Go consumer
|
||||
minimum as described below; and
|
||||
- a patch release may make backward-compatible fixes.
|
||||
|
||||
Before `v1.0.0`, a minor release may change a documented public, operational,
|
||||
@@ -87,6 +91,36 @@ Additional compatibility promises and deliberate exceptions belong in the
|
||||
adopted policy or canonical contract documentation. Release notes explain
|
||||
changes; they do not redefine current compatibility contracts.
|
||||
|
||||
## Consumer Minimum And Release Toolchain
|
||||
|
||||
Distinguish the minimum toolchain supported for consumers from the toolchain
|
||||
maintainers use to build and validate a release. Record the consumer minimum in
|
||||
the language's standard metadata and explain its support meaning in canonical
|
||||
documentation. Define the selected release toolchain and its setup commands in
|
||||
`docs/release.md`. Toolchain selection and upgrade cadence are repository-specific
|
||||
choices.
|
||||
|
||||
For Go repositories, normally declare the initial stable release of the selected
|
||||
series as the consumer minimum, such as `go 1.26.0`. Use a higher patch minimum
|
||||
when a dependency or an identified correctness fix requires it, and document
|
||||
the reason.
|
||||
|
||||
For release-policy purposes, successful build and release validation on the
|
||||
selected Go patch release are sufficient to presume support across that Go
|
||||
series, subject to the declared consumer minimum and concrete evidence of
|
||||
incompatibility. Investigate specific compatibility concerns as they arise.
|
||||
|
||||
Use the selected release toolchain for candidate validation and release builds,
|
||||
including CI jobs performing those tasks. A newer validation patch version alone
|
||||
leaves the consumer minimum unchanged.
|
||||
|
||||
A minor release may raise the Go consumer minimum, including from one Go series
|
||||
to the next, both before and after `v1.0.0`. This is an explicit exception to the
|
||||
backward-compatibility requirement for minor releases. Patch releases preserve
|
||||
the consumer minimum. Explain an increase's impact and required consumer action
|
||||
in the release note. Other incompatible changes remain subject to the versioning
|
||||
rules above.
|
||||
|
||||
## Release Documentation And Preparation
|
||||
|
||||
Every new release must include `docs/releases/<version>.md` in the tagged
|
||||
@@ -145,9 +179,10 @@ caches are not required. If the candidate changes, validate the new candidate.
|
||||
Cheap publication-state checks may be repeated immediately before pushing
|
||||
because local or remote state may have changed during validation.
|
||||
|
||||
Automate mechanical guards. Do not require manual approvals, sign-offs, or
|
||||
routine confirmations as release gates. Version selection and
|
||||
a concise release summary remain preparation inputs, not separate approval rounds.
|
||||
Automate mechanical guards. Human review gates are strongly disfavored: add one
|
||||
only through an explicit project-specific policy decision explaining the
|
||||
concrete risk and why ordinary change review or automation is insufficient.
|
||||
Do not add routine confirmations for checks the command can perform itself.
|
||||
|
||||
## Publication Guards
|
||||
|
||||
@@ -201,7 +236,8 @@ release without replacing its contents or reusing its version.
|
||||
Maintain `docs/release.md` as a short, executable maintainer runbook. It must
|
||||
identify:
|
||||
|
||||
1. prerequisites, primary branch, and authoritative remote;
|
||||
1. prerequisites, selected release toolchain, primary branch, and authoritative
|
||||
remote;
|
||||
2. version and release-note preparation;
|
||||
3. one publication command with its selected local checks and automated guards;
|
||||
4. declared deliverables, required build targets, and automation responsibilities;
|
||||
|
||||
@@ -7,11 +7,32 @@ Woodpecker reports binary delivery separately.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Use Bash, Git, and Go 1.25.5 or newer. The authoritative remote is `origin`,
|
||||
Use Bash and Git. The authoritative remote is `origin`,
|
||||
which must point to `https://gitea.maximumdirect.net/eric/audita.git`; the
|
||||
primary branch is `main`. Source publication needs no delivery credential.
|
||||
Woodpecker uses the existing `GITEA_RELEASE_TOKEN` secret for delivery.
|
||||
|
||||
The source-build minimum is Go 1.25.5, declared in [go.mod](../go.mod).
|
||||
This patch minimum is required by the selected PromptKit dependency.
|
||||
Distributed executables do not require a Go installation. The selected release
|
||||
toolchain is Go 1.25.5, matching the current Woodpecker image and distributed
|
||||
runtime notices. Use that local installation for tool bootstrap, candidate
|
||||
validation, and release builds. Replace the installation path below with its
|
||||
actual directory:
|
||||
|
||||
```sh
|
||||
export PATH="/path/to/go1.25.5/bin:$PATH"
|
||||
export GOTOOLCHAIN=local
|
||||
go version
|
||||
```
|
||||
|
||||
Record the reported toolchain with the validation results. The
|
||||
[release policy](policy/release.md#consumer-minimum-and-release-toolchain)
|
||||
governs the distinction between the consumer minimum and release toolchain,
|
||||
support across a Go series, and versioning of minimum increases. When selecting
|
||||
a different release toolchain, update the CI image and applicable runtime
|
||||
attribution together; a newer build patch alone need not raise the minimum.
|
||||
|
||||
Prepare dependencies before offline candidate validation:
|
||||
|
||||
```sh
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# ReleaseKit v0.3.0 Upgrade Roadmap
|
||||
|
||||
**Last updated:** 2026-10-08
|
||||
**Status:** Agreed scope; implementation pending.
|
||||
**Status:** Release policy adopted; library and toolchain upgrade pending.
|
||||
|
||||
## Purpose
|
||||
|
||||
@@ -41,6 +41,11 @@ At Audita commit `17421bc5f352f3fdeb67561b2b60b49979822228`:
|
||||
The initial adoption's [review findings](remediation.md) are resolved. They are
|
||||
historical context, not additional work for this upgrade.
|
||||
|
||||
Since that baseline, Audita has adopted release policy 1.6 and updated its
|
||||
provenance, policy attribution, and release runbook. The current Go minimum and
|
||||
selected release toolchain remain 1.25.5. The dependency, tool registration,
|
||||
bootstrap simplification, and Go 1.26 upgrade described below remain pending.
|
||||
|
||||
## Selected Upstream Revisions
|
||||
|
||||
Adopt ReleaseKit **v0.3.0**, commit
|
||||
@@ -56,7 +61,7 @@ structured diagnostics. Audita already uses its module-selected CI bootstrap
|
||||
approach. The largest file-validation performance gains apply only when those
|
||||
checks are selected; this upgrade does not enable them merely to obtain gains.
|
||||
|
||||
For the release-policy update, use Standard Repository Policies **version 1.6**
|
||||
The adopted release policy uses Standard Repository Policies **version 1.6**
|
||||
at commit `e833faddf120c789a9b45348edaf75720de16348`, following its
|
||||
[adoption guide](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/docs/adoption.md).
|
||||
Other locally adopted policies retain their existing upstream revisions.
|
||||
@@ -118,18 +123,14 @@ tag verification before Go bootstrap and temporary metadata outside the tagged
|
||||
checkout where the upstream CI template uses it. The local and CI integrations
|
||||
need not have identical preparation machinery when their responsibilities differ.
|
||||
|
||||
### Release Policy and Documentation
|
||||
### Policy Alignment and Documentation
|
||||
|
||||
Update `docs/policy/release.md` using the selected upstream 1.6 revision. Adopt
|
||||
upstream wording for shared requirements, remove template-only instructions,
|
||||
and retain Audita's justified platform commitments and accepted native-host
|
||||
version check. Preserve main-first publication, independent source completion,
|
||||
and proportionate automated gates. No human release gate is introduced.
|
||||
|
||||
Record the adopted version, local update date, and exact per-document upstream
|
||||
source. Keep mixed-revision policy attribution accurate rather than implying
|
||||
that the whole policy suite was refreshed. Existing public discovery links and
|
||||
unrelated policy adoption metadata remain applicable.
|
||||
The release-policy update is complete. `docs/policy/release.md` now incorporates
|
||||
the selected upstream 1.6 revision, with template-only instructions removed and
|
||||
Audita's platform commitments and accepted native-host version check retained.
|
||||
It preserves independent source completion and proportionate automated gates.
|
||||
Mixed-revision attribution records the policy's exact source separately from
|
||||
the other adopted policies. No human release gate was introduced.
|
||||
|
||||
Update `docs/release.md` and `docs/development.md` for the source minimum,
|
||||
selected release toolchain, dependency preparation, and simplified local
|
||||
@@ -150,8 +151,9 @@ requirement alone does not establish incorporation into Audita binaries.
|
||||
|
||||
Update Go runtime and standard-library notices, including relevant vendored
|
||||
components, for the selected Go 1.26.8 release-build toolchain. Reuse existing
|
||||
license texts where applicable. Update the copied release policy's scope and
|
||||
commit-specific source and notice links under the existing OSS policy.
|
||||
license texts where applicable. The copied release policy's scope and
|
||||
commit-specific source and notice links have already been updated; preserve
|
||||
that accurate mixed-revision attribution during the remaining upgrade work.
|
||||
|
||||
### Consumer Verification and Test Maintenance
|
||||
|
||||
|
||||
Reference in New Issue
Block a user