eric/audita
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Upgrade ReleaseKit and simplify release tooling

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-09 04:09:26 +00:00
parent 11c349d9ae
commit 6debe7e641
10 changed files with 147 additions and 247 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/development.md
View File

@@ -41,7 +41,9 @@ ownership. Commit discipline and agent Git restrictions are in the
## Baseline Validation
Use Go 1.25.5 or newer. From the repository root:
Use Go 1.26.0 or newer for source builds. The selected release toolchain is
documented in the [release procedure](release.md#prerequisites). From the
repository root:
```sh
go build -o ./bin/audita ./cmd/audita

46
docs/oss/attribution.md
View File

@@ -38,7 +38,7 @@ License and notices: [LGPL v3](licenses/LGPL-3.0.txt) |
## ReleaseKit
Selected module: `gitea.maximumdirect.net/eric/ReleaseKit` at `v0.1.0`.
Selected module: `gitea.maximumdirect.net/eric/ReleaseKit` at `v0.3.0`.
Copyright (C) 2026 Eric Rakestraw
@@ -46,79 +46,79 @@ SPDX-License-Identifier: LGPL-3.0-or-later
License and notices: [LGPL v3](licenses/LGPL-3.0.txt) |
[GPL v3](licenses/GPL-3.0.txt) |
[COPYRIGHT](https://gitea.maximumdirect.net/eric/ReleaseKit/src/commit/5e60fe3113c69f95c42fbbe32a8ca4b51f5b83c1/COPYRIGHT).
[COPYRIGHT](https://gitea.maximumdirect.net/eric/ReleaseKit/src/commit/e43df4416e0ed987349b2ea04a2c68c25e552772/COPYRIGHT).
[Source](https://gitea.maximumdirect.net/eric/ReleaseKit/src/commit/5e60fe3113c69f95c42fbbe32a8ca4b51f5b83c1).
[Source](https://gitea.maximumdirect.net/eric/ReleaseKit/src/commit/e43df4416e0ed987349b2ea04a2c68c25e552772).
## Go runtime and standard library
Selected toolchain: Go 1.25.5 for the distributed Linux binaries.
Selected toolchain: Go 1.26.8 for the distributed Linux binaries.
Copyright 2009 The Go Authors.
SPDX-License-Identifier: BSD-3-Clause
License and notices: [BSD 3-Clause](licenses/BSD-3-Clause-Go.txt) |
[LICENSE](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/PATENTS).
[LICENSE](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/PATENTS).
[Source](https://github.com/golang/go/commit/fefb02adf45c4bcc879bd406a8d61f2a292c26a9).
[Source](https://github.com/golang/go/commit/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e).
## Go vendored golang.org/x/crypto
Material: `golang.org/x/crypto` at `v0.39.0` in the Go 1.25.5 standard library.
Material: `golang.org/x/crypto` at `v0.46.1-0.20251210140736-7dacc380ba00` in the Go 1.26.8 standard library.
Copyright 2009 The Go Authors.
SPDX-License-Identifier: BSD-3-Clause
License and notices: [BSD 3-Clause](licenses/BSD-3-Clause-Go.txt) |
[LICENSE](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/src/vendor/golang.org/x/crypto/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/src/vendor/golang.org/x/crypto/PATENTS).
[LICENSE](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/src/vendor/golang.org/x/crypto/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/src/vendor/golang.org/x/crypto/PATENTS).
[Source](https://github.com/golang/go/commit/fefb02adf45c4bcc879bd406a8d61f2a292c26a9).
[Source](https://github.com/golang/go/commit/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e).
## Go vendored golang.org/x/net
Material: `golang.org/x/net` at `v0.41.0` in the Go 1.25.5 standard library.
Material: `golang.org/x/net` at `v0.47.1-0.20260731170545-cb1d721f7fb3` in the Go 1.26.8 standard library.
Copyright 2009 The Go Authors.
SPDX-License-Identifier: BSD-3-Clause
License and notices: [BSD 3-Clause](licenses/BSD-3-Clause-Go.txt) |
[LICENSE](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/src/vendor/golang.org/x/net/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/src/vendor/golang.org/x/net/PATENTS).
[LICENSE](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/src/vendor/golang.org/x/net/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/src/vendor/golang.org/x/net/PATENTS).
[Source](https://github.com/golang/go/commit/fefb02adf45c4bcc879bd406a8d61f2a292c26a9).
[Source](https://github.com/golang/go/commit/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e).
## Go vendored golang.org/x/sys
Material: `golang.org/x/sys` at `v0.33.0` in the Go 1.25.5 standard library.
Material: `golang.org/x/sys` at `v0.39.0` in the Go 1.26.8 standard library.
Copyright 2009 The Go Authors.
SPDX-License-Identifier: BSD-3-Clause
License and notices: [BSD 3-Clause](licenses/BSD-3-Clause-Go.txt) |
[LICENSE](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/src/vendor/golang.org/x/sys/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/src/vendor/golang.org/x/sys/PATENTS).
[LICENSE](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/src/vendor/golang.org/x/sys/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/src/vendor/golang.org/x/sys/PATENTS).
[Source](https://github.com/golang/go/commit/fefb02adf45c4bcc879bd406a8d61f2a292c26a9).
[Source](https://github.com/golang/go/commit/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e).
## Go vendored golang.org/x/text
Material: `golang.org/x/text` at `v0.26.0` in the Go 1.25.5 standard library.
Material: `golang.org/x/text` at `v0.32.0` in the Go 1.26.8 standard library.
Copyright 2009 The Go Authors.
SPDX-License-Identifier: BSD-3-Clause
License and notices: [BSD 3-Clause](licenses/BSD-3-Clause-Go.txt) |
[LICENSE](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/src/vendor/golang.org/x/text/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/fefb02adf45c4bcc879bd406a8d61f2a292c26a9/src/vendor/golang.org/x/text/PATENTS).
[LICENSE](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/src/vendor/golang.org/x/text/LICENSE) |
[PATENTS](https://github.com/golang/go/blob/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e/src/vendor/golang.org/x/text/PATENTS).
[Source](https://github.com/golang/go/commit/fefb02adf45c4bcc879bd406a8d61f2a292c26a9).
[Source](https://github.com/golang/go/commit/c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e).
## go-yaml v4

32
docs/release.md
View File

@@ -2,8 +2,8 @@
The [release policy](policy/release.md) owns release requirements. This runbook
uses the native commands in [scripts/release.sh](../scripts/release.sh), which
builds and invokes ReleaseKit. A confirmed source tag completes the release;
Woodpecker reports binary delivery separately.
invokes the module-selected ReleaseKit tool. A confirmed source tag completes
the release; Woodpecker reports binary delivery separately.
## Prerequisites
@@ -12,16 +12,16 @@ which must point to `https://gitea.maximumdirect.net/eric/audita.git`; the
primary branch is `main`. Source publication needs no delivery credential.
Woodpecker uses the existing `GITEA_RELEASE_TOKEN` secret for delivery.
The source-build minimum is Go 1.25.5, declared in [go.mod](../go.mod).
This patch minimum is required by the selected PromptKit dependency.
The source-build minimum is Go 1.26.0, declared in [go.mod](../go.mod).
This minimum is required by the selected ReleaseKit dependency.
Distributed executables do not require a Go installation. The selected release
toolchain is Go 1.25.5, matching the current Woodpecker image and distributed
toolchain is Go 1.26.8, matching the current Woodpecker image and distributed
runtime notices. Use that local installation for tool bootstrap, candidate
validation, and release builds. Replace the installation path below with its
actual directory:
```sh
export PATH="/path/to/go1.25.5/bin:$PATH"
export PATH="/path/to/go1.26.8/bin:$PATH"
export GOTOOLCHAIN=local
go version
```
@@ -40,10 +40,12 @@ GOWORK=off GOTOOLCHAIN=local go mod download
```
If dependency preparation changes `go.mod` or `go.sum`, include those changes in
the committed candidate. The release wrapper separately builds the ReleaseKit
version selected by `go.mod` into ignored `bin/releasekit`. It uses temporary
copies of `go.mod` and `go.sum` for tool dependency preparation; that build is
tool preparation, not candidate validation.
the committed candidate. ReleaseKit's CLI is registered as a Go tool dependency;
`go mod tidy` retains its dependencies and checksums. The release wrapper changes
to the repository root and invokes `go tool releasekit` with workspace discovery
and automatic toolchain downloads disabled. Go builds or reuses the selected
tool from its normal build cache. Tool preparation precedes offline candidate
validation.
## Prepare and publish the candidate
@@ -106,7 +108,7 @@ out detached, and confirms the source tree is clean. It copies the tagged
`go.mod` and `go.sum` into temporary module metadata outside the checkout. Go
confirms that this configuration selects ReleaseKit, then builds its CLI using
an alternate `-modfile`. The bootstrap executable and temporary files remain
outside the tagged source. The workflow runs with the existing Go 1.25.5 image,
outside the tagged source. The workflow runs with the selected Go 1.26.8 image,
`GOWORK=off`, and `GOTOOLCHAIN=local`.
The resulting executable receives:
@@ -125,8 +127,8 @@ after source publication; its status and logs report delivery progress or
failure.
ReleaseKit handles content-aware retries and retained-artifact recovery. See
the pinned [publication recovery guide](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.1.0/docs/consumers/publish.md)
and [delivery guide](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.1.0/docs/consumers/delivery.md)
the pinned [publication recovery guide](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.3.0/docs/consumers/publish.md)
and [delivery guide](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.3.0/docs/consumers/delivery.md)
for those mechanics. A delivery failure does not undo a confirmed source
release. Retry the same immutable tag after resolving the reported state; do not
replace published files or a checksum manifest.
@@ -139,11 +141,11 @@ captured authoritative endpoint and publication state. Resolve the result
against that endpoint before retrying. An exact remote tag-object match, with
its source available on remote `main`, can confirm publication. If the remote
state cannot be read, the result remains unknown; do not remove or replace the
tag while uncertain. Follow the pinned [publication recovery guide](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.1.0/docs/consumers/publish.md)
tag while uncertain. Follow the pinned [publication recovery guide](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.3.0/docs/consumers/publish.md)
for object-level recovery details.
A source-release success and artifact-delivery status are separate. For a
partial or uncertain delivery, inspect the job output and follow the pinned
[delivery recovery guidance](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.1.0/docs/consumers/delivery.md).
[delivery recovery guidance](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.3.0/docs/consumers/delivery.md).
A source or published-content correction requires a new appropriate version;
leave the original tag and its contents intact.

39
docs/roadmap/releasekit.md
View File

@@ -1,7 +1,8 @@
# ReleaseKit v0.3.0 Upgrade Roadmap
**Last updated:** 2026-10-08
**Status:** Release policy adopted; library and toolchain upgrade pending.
**Status:** Implementation complete; first upgraded release and live delivery
observation pending.
## Purpose
@@ -11,9 +12,9 @@ ReleaseKit; Audita supplies product facts, compatibility decisions, release
notes, and thin integration wiring. Standardization and less locally owned
release code remain the reasons for adoption.
This roadmap replaces the completed initial-adoption roadmap. It defines the
upgrade's target state and required work; a later implementation plan can own
ordered execution steps.
This roadmap replaces the completed initial-adoption roadmap. It records the
upgrade's target state and completed scope. The upgrade was implemented in one
pass without a separate staged plan.
## Current Baseline
@@ -41,10 +42,11 @@ At Audita commit `17421bc5f352f3fdeb67561b2b60b49979822228`:
The initial adoption's [review findings](remediation.md) are resolved. They are
historical context, not additional work for this upgrade.
Since that baseline, Audita has adopted release policy 1.6 and updated its
provenance, policy attribution, and release runbook. The current Go minimum and
selected release toolchain remain 1.25.5. The dependency, tool registration,
bootstrap simplification, and Go 1.26 upgrade described below remain pending.
Since that baseline, Audita has adopted release policy 1.6, registered and
upgraded the ReleaseKit tool to v0.3.0, simplified the local wrapper, and
updated CI and notices. The current Go minimum is 1.26.0; the selected release
toolchain is 1.26.8. The scope below records the requirements fulfilled by this
implementation.
## Selected Upstream Revisions
@@ -94,7 +96,7 @@ increases in minor releases, with the increase and required source-consumer
action explained in the release note. Patch releases preserve the consumer
minimum. Other compatibility changes remain governed by the adopted policy.
## Work Required
## Implemented Scope
### Module Selection and Local Tooling
@@ -208,3 +210,22 @@ asynchronously when the first upgraded release is published and address any
deployment failures through the shared recovery procedure. No significant
feature decisions remain open; implementation details and final release
preparation can be resolved within the agreed scope.
## Implementation Completion
Completed with Go 1.26.8. The readonly offline full suite passed. The real local
wrapper selected ReleaseKit v0.3.0; disposable Go-tool fixtures verified native
argument boundaries, statuses 0/2/3, and unchanged module files. The CI workflow
matches the v0.3.0 maintained template with Audita's existing secret mapping.
The real ReleaseKit builder produced both required Linux artifacts using the
test identifier v0.0.0, passed its native version smoke check, and emitted
matching artifact digests in its build receipt. Temporary output was removed.
The new release-tool dependencies are absent from Audita's runtime dependency
list. ReleaseKit and Go runtime/vendor attribution identify their selected
source revisions, with existing applicable license texts reused.
This verification built modified local source and did not claim a clean,
published release candidate. Release preparation will validate its final
committed candidate through the ordinary publication command. No tags, source
pushes, hosted uploads, or LLM calls were made during implementation; live
artifact delivery remains a separate observation for the next release.