Repository navigation
ci(release): publish from a pushed tag with the registry token, as in 0.10.1 - #118
Merged
Merged
Conversation
… 0.10.1 0.11.0 made publish.yml require a GitHub-verified signed tag and publish through crates.io trusted publishing only. Neither was ever set up (no signing key registered, no trusted publishers, and trusted publishing cannot create the new id_effect_rpc_macros and id_effect_lints), so the v0.11.0 and v0.12.0 runs failed at their first job. Back to the 0.10.1 flow: any pushed v* tag starts the release and the publish job logs in with the CARGO_REGISTRY_TOKEN secret (crates-io environment), which can also publish a crate's first version. The rest of the 0.11 pipeline stays: pre-publish tests, packaging validation, SBOMs, SLSA provenance, digest checks against crates.io and the GitHub Release. Signed-off-by: Tom Wieland <tom.wieland@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Biome 2.6.0 and 2.6.1 (published 2026-10-21) install from npm without their
platform binary ("Cannot find module '@biomejs/cli-linux-x64/biome'"), which
fails effect:ci-format and with it every Moon CI run. Pin the last version
the green runs used.
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #118 +/- ##
=======================================
Coverage 97.86% 97.87%
=======================================
Files 552 552
Lines 117984 117984
=======================================
+ Hits 115465 115471 +6
+ Misses 2519 2513 -6 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Industrial
added a commit
that referenced
this pull request
Oct 25, 2026
…w8-kpis) docs/security/kpis-0.13.json regenerated by bash scripts/security-kpis.sh 0.13.0 (online, live tests): security_table green, security_releases pending (12 of 13 0.10.1 rows await a published GHSA, 0 published). Fails on fuzz_open_crashes (rpc_duplex_frame, owner id_effect_rpc), openssf_scorecard 6.6, and two KPIs the merged 0.12.0 release fix (#118) brings back: registry_token (CARGO_REGISTRY_TOKEN under .github, S3) and open_highs (the S6 test s6_release_requires_signed_tag no longer exists); the notes name the owner decision. CHANGELOG entry updated. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial
added a commit
that referenced
this pull request
Oct 25, 2026
…cision (r13-w8-kpis) kpis-0.13.json notes: registry_token and the open_highs register problem follow from the owner's #118 release flow (merged at 432ac57), not reverted; findings.json and SECURITY.md still describe the 0.11 flow. CHANGELOG entry reworded. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial
added a commit
that referenced
this pull request
Oct 25, 2026
…owner decision (r13-w8-kpis) scripts/security-kpis.sh: registry_token passes with accepted and the register note when docs/security/findings.json records S3 as accepted (self-test cases). kpis-0.13.json: registry_token and the S6 open_highs register problem carry the owner decision of 2026-10-24 (keep the #118 release flow; accepted, not a regression); release prep updates findings.json and SECURITY.md. fuzz_open_crashes keeps pointing at the rpc_duplex_frame fix in id_effect_rpc. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial
added a commit
that referenced
this pull request
Oct 25, 2026
…ision; KPIs re-measured docs/security/findings.json: S3 (long-lived CARGO_REGISTRY_TOKEN) and S6 (unsigned tags) accepted, reason owner decision 2026-10-24 (#118, 3e9104e); S6 drops the removed s6_release_requires_signed_tag and keeps the DCO test. THREAT-MODEL.md: B8 rows, an Accepted risks section and the register rows. SECURITY.md: 0.13.x supported, 0.12.x security fixes until 2027-01-23; Supply chain describes the actual flow (pushed v* tag, registry token, new crates created on first publish, SLSA provenance and digest checks kept). docs/RELEASING.md: no signed-tag check, the 0.11 owner steps kept only as a record. docs/security/kpis-0.13.json: open_highs and registry_token re-measured offline (both pass: 0 register problems, S3 accepted); fuzz_open_crashes pending: the rpc_duplex_frame crash is fixed by e9032b4, main's batch run (40173339047) still runs the pre-fix code until the merge. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial
added a commit
that referenced
this pull request
Oct 25, 2026
…corecard CI for 0.13.0 CHANGELOG: "## 0.13.0 — 2026-10-25 — Breadth" with an intro; the KPI and Security bullets record the rpc_duplex_frame crash as fixed (e9032b4) and S3/S6 as accepted; owner steps: publish the 0.10.1 advisories (sec.supply#7), push v0.13.0. ADR 0015 Accepted (D16, 2026-10-21, D1-D15 as written; §15 notes the 0.45 pair limit). PLAN-OF-PLANS §11 and the release spec record D16, the eager pair limit 0.45 (F66) and keeping the #118 release flow (D17 superseded); scorecard block no longer provisional. ci.yml diffs the stored 0.13.0 result and runs --diff 0.12.0 0.13.0 --compare-targets 0.13.0. docs/benchmarks/README.md: eager pair <= 0.45. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial
added a commit
that referenced
this pull request
Oct 25, 2026
The publish workflow no longer checks a tag signature (owner decision 2026-10-24, #118; S6 accepted), so CONTRIBUTING no longer says it refuses unsigned tags. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial
added a commit
that referenced
this pull request
Oct 25, 2026
id_effect 0.13.0 "Breadth" (ADR 0015) adds: - id_effect_admin and id_effect_i18n. - id_effect_ai at the integration tier: chat, tools, structured output, embeddings, and an MCP server and client pinned to the 2026-07-28 spec revision. - SQL relations, eager loading, keyset pagination, lifecycle hooks and one database per tenant. - Server-rendered maud/htmx views and a Leptos SSR recipe. - WebTransport in the host, WebSockets over HTTP/2, and HTTP/3 0-RTT and congestion settings. - RPC client batching and a wss:// client. - The Pipeline reference app. Release records: the blind re-score measures E 86.8 against a target of 85.2. ADR 0015 is Accepted (D16). Owner decisions of 2026-10-24: the eager-loading bench pair limit is 0.45 (follow-up F66), and S3/S6 are accepted with the #118 release flow. Signed-off-by: Tom Wieland <tom.wieland@gmail.com> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restores the 0.10.1 release flow so a pushed tag lets GitHub Actions do the release again.
0.11.0 (#111) made
publish.ymlrequire a GitHub-verified signed tag and publish through crates.io trusted publishing only. Neither was set up (no signing key registered; no trusted publishers; trusted publishing also cannot create the newid_effect_rpc_macrosandid_effect_lints), so the v0.11.0 and v0.12.0 runs failed at their first job.v*tag starts a real release again (no signature check).CARGO_REGISTRY_TOKENsecret of thecrates-ioenvironment, as 0.10.1 did; it can also publish a crate's first version, so the plan no longer refuses new crates.docs/RELEASING.mdupdated.Supersedes #117. Local: actionlint, shellcheck,
bash -n; plan mode against the live index plans both new crates andid_effect0.12.0.🤖 Generated with Claude Code