eric/promptkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Resolve the ReleaseKit adoption decisions

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-08 13:36:01 +00:00
parent 3add7024db
commit 41b2021d8c
1 changed files with 11 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
docs/roadmap/releasekit.md
View File

@@ -1,6 +1,6 @@
# ReleaseKit Adoption Roadmap
Status: Adoption scope for review; implementation has not started.
Status: Adoption scope agreed; implementation has not started.
A companion staged implementation plan will define the implementation steps.
## Purpose
@@ -153,8 +153,10 @@ the upstream recovery contract. Published tags and historical notes retain
their contents. CI, hosted delivery, and module availability are separate
from successful source publication.
Hosted note-page delivery remains the decision described at the end of this
roadmap.
This adoption covers source publication. Hosted note-page delivery is left
for a separately selected expansion; PromptKit currently has no hosted CI,
and delivery would add workflow and credential provisioning beyond the
immediate standardization scope.
## Changes Needed From The Current Baseline
@@ -187,9 +189,11 @@ workspace/local-replacement selections for the established
The current blanket rejection of all replacement directives gives way to
that more precise upstream check.
The recommended target also retires the mandatory credential regex,
subject to Open Decision 2. Ordinary credential-aware change review remains
part of development. No replacement scanner is required for adoption.
Retire the mandatory credential regex. Its limited formats and possible
matches against synthetic fixtures do not justify keeping a separate local
release gate. Ordinary credential-aware change review remains part of
development, including the obligation to keep actual credentials out of
source. No replacement scanner is required for adoption.
### Align Policy And Documentation
@@ -232,42 +236,8 @@ Adoption is complete when the implemented release path uses ReleaseKit,
the selected shared validators replace local equivalents, the retained
example check is integrated, and policies and runbooks describe the actual
workflow. Source-publication testing requires no provider credentials or
live inference. If hosted delivery is selected, its integration has its own
verification and delivery status.
live inference.
The desired reduction is in owned machinery and routine decisions, not a
fixed deletion count. The companion implementation plan will divide this
migration into appropriately scoped stages.
## Open Decisions
### 1. Include Hosted Gitea Release Notes In This Adoption?
**Recommendation:** Adopt source publication first and leave hosted delivery
for a separately selected expansion. This achieves the immediate
standardization and maintenance goals. PromptKit currently has no hosted CI;
introducing a runner workflow and delivery credentials adds operational
scope rather than enabling the shared validation features.
**Alternative:** Include asynchronous page-only delivery using ReleaseKit's
maintained module-selected Woodpecker integration. This follows upstream's
broader consumer direction and improves release discoverability with little
bespoke implementation. It requires a delivery profile, CI configuration,
credentials, and documented delivery retries. The released tag selects the
tool for retries, and successful source publication still completes the
release independently of page delivery.
### 2. Retire Or Retain The Credential-Pattern Gate?
**Recommendation:** Retire the mandatory regex scan and retain ordinary
credential-aware change review. Its limited formats and possible matches
against synthetic fixtures do not justify preserving a separate local gate
merely because ReleaseKit has no equivalent. This simplifies publication
without changing the obligation to keep actual credentials out of source.
**Alternative:** Retain the small existing scan as a focused additional
check if its independent automated signal is considered worth its cost and
false positives. This catches some recognizable accidentally committed
formats but leaves a local validation fragment to maintain and is not
comprehensive detection. It does not require a new upstream security
subsystem.