Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Phase 16] S12 — Release DAG and release-time evidence

Open
  • Is something wrong?
#898 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
8/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, python
Domain
build-system, devops, release, security

Research direction

Start with the step plan in docs/roadmap/phase-16-trust-surface-hardening.md (lines 636-680) and the release workflow it describes, and note that #889 must land first as the review standard. The issue spans many units and needs throwaway-tag verification on a scratch branch, so it is not a first task. Done means the listed exit criteria pass: the wheel-contract step fails on a missing package-data glob while pytest tests/ stays green, and a supply-chain gate blocks publish.

Written by the indexing model from the issue text.

Description

phase: 16 source: roadmap

Roadmap · Phase 16, step S12 · size XL · 9 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:636-680

Summary

Every unit is a defect in the release DAG or in the evidence that DAG should produce, and they share one blast radius: they can only be verified by pushing throwaway tags. Zero lines of the wheel's Python modules execute in any of the twelve release-matrix cells — tests/__init__.py plus pytest's default prepend import mode put the checkout ahead of site-packages — and the SBOM step is metadata-only. What the matrix really gates (wheel build, metadata validity, twine check, cross-platform dependency resolution) is kept.

Units

Unit Tracked by (October 2026 review)
F-W20260729-OPS-01 #110 · #111 · #558 · #566 · #702 · #704 · #748
F-W20260729-OPS-02, F-W20260729-OPS-03, F-W20260729-OPS-04, F-W20260729-OPS-05, F-W20260729-OPS-06, F-W20260729-OPS-15, F-W20260729-OPS-16, F-W20260729-OPS-19 #114 · #303 · #423 · #465 · #533 · #558 · #566 · #607 · #638 · #668 · #686 · #702 · #776 · #795

Blocked by

#889 — the standard this step is reviewed against; write it first.

Decisions this step executes

  • C-12 — wheel testing: keep the source suite and add a wheel-contract step.
  • C-13 — the release-record check exempts PEP 440 pre-releases; tag ↔ version and ancestry are still enforced for every tag.
  • C-14 — publishing is gated on a supply-chain scan.

Plan

  • Add a wheel-contract step run from outside the checkout, mirroring the nightly's wheel-install-smoke.
  • Add a supply-chain-gate job that runs the nightly's two helpers against the tagged SHA.
  • Local verification is impossible for four criteria: use a scratch branch and throwaway v0.0.0-test-* tags per rejection case plus a deliberately broken wheel; then restore, re-tag green, delete every throwaway tag from the remote and confirm no [X.Y.Z] heading was left in CHANGELOG.md.

Exit criteria

  • Omitting a package-data glob turns the matrix red at the wheel-contract step while pytest tests/ stays green.
  • A mismatched, off-main or record-less tag cannot reach build.
  • A tagged SHA with an unsuppressed pip-audit finding cannot reach publish; a clean one leaves a retained artefact referencing that SHA.
  • Every referable BOM object has a globally unique bom-ref, validated against the official CycloneDX schema plus the semantic checks the schema cannot express.
  • The exact documented command downloads all SBOMs for a real released tag.
  • A policy guard rejects any non-local uses: that is not a full 40-character SHA.
  • A meta-test compares documentation claims against the workflow trigger inventory, so no document can claim enforcement CI does not perform.

How to deliver

  • One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
  • A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
  • Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
  • A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
  • Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.

Dominant language
Python
Stars
9
Forks
1
Avg merge
8h 10m
Merged PRs (30d)
5

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from HodeTech/ForgeLM

All issues in HodeTech/ForgeLM

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.