feat(007): release distribution (tag-gated prebuilt binaries + installer)#8
Merged
Merged
Conversation
- specs/007: release-distribution spec (implementation in progress until the first live release is verified) - release.yml: fail-fast tag-vs-Cargo.toml version guard, five-triple build matrix (--locked), per-target .sha256 sidecar, CycloneDX SBOM (fail-closed on zero components), SLSA build-provenance attestation, idempotent publish with generated notes; actions SHA-pinned - install.sh: curl|sh installer; checksum verification required, provenance attestation best-effort with STATECRAFT_REQUIRE_ATTESTATION escalation; musl refused with a cargo install pointer - README: install section; status updated to reflect implemented 002-006 - .derived: recompiled shards, including the stagecraft-cli -> statecraft-cli by-package rename fallout
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v<semver>tag now produces a GitHub Release with prebuilt binaries for five targets. The spec establishes.github/workflows/release.ymlandinstall.shand records the design decisions (barev*tag grammar, matrix shape, supply-chain evidence, no registry publishing).--locked; x86_64-apple-darwin cross-compiles on the Apple Silicon runner),.sha256sidecar per archive, per-target CycloneDX SBOM (fail-closed on zero components), SLSA build-provenance attestation per archive, idempotent publish with generated notes. Every action SHA-pinned with a version comment, same rule as ci.yml.curl | shinstaller; detects platform/arch, verifies the checksum (hard requirement) and the provenance attestation (best-effort viagh;STATECRAFT_REQUIRE_ATTESTATION=1escalates to hard-fail). musl Linux refused with acargo install --gitpointer. Overrides:STATECRAFT_VERSION,STATECRAFT_BIN_DIR,STATECRAFT_SKIP_ATTESTATION.stagecraft-cli->statecraft-cliby-package rename fallout from PR Rename #7.Spec 007 stays
implementation: in-progressuntil the first live release is verified end to end (acceptance §6); the follow-up PR records that transcript and flips it to complete.Testing
spec-spine compile/lint --fail-on-warn/index checkgreen;couplegreen apart from the waived README path below.cargo fmt --check,cargo clippy --all-targets -- -D warnings,cargo test(16 passed).actionlintclean on release.yml;sh -nclean on install.sh.cargo build --release --locked --target x86_64-apple-darwinon an Apple Silicon machine produces a valid x86_64 Mach-O; Cargo.lock pinsring(noaws-lc-sys).Spec-Drift-Waiver: README.md is established by spec 001 (the thesis owns the repo's front door), and ownership overrides the
**/README.mdbypass prefix mechanically. This PR's README edit only documents the spec 007 install surface and refreshes the stale pre-code status paragraph; none of 001's decided constraints (binary name, Rust, stdio MCP, Apache-2.0, no TUI) are touched, and spec-spine.toml's own bypass_prefixes already expresses that README prose is ungated documentation. A coupling waiver, not a coherence override.