Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Phase 16] S12 — Release DAG and release-time evidence

Abierto
  • ¿Algo no está bien?
#898 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
8/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
github-actions, python
Área
build-system, devops, release, security

Línea de trabajo

Start with the step plan in docs/roadmap/phase-16-trust-surface-hardening.md (lines 636-680) and the release workflow it describes, and note that #889 must land first as the review standard. The issue spans many units and needs throwaway-tag verification on a scratch branch, so it is not a first task. Done means the listed exit criteria pass: the wheel-contract step fails on a missing package-data glob while pytest tests/ stays green, and a supply-chain gate blocks publish.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

phase: 16 source: roadmap

Roadmap · Phase 16, step S12 · size XL · 9 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:636-680

Summary

Every unit is a defect in the release DAG or in the evidence that DAG should produce, and they share one blast radius: they can only be verified by pushing throwaway tags. Zero lines of the wheel's Python modules execute in any of the twelve release-matrix cells — tests/__init__.py plus pytest's default prepend import mode put the checkout ahead of site-packages — and the SBOM step is metadata-only. What the matrix really gates (wheel build, metadata validity, twine check, cross-platform dependency resolution) is kept.

Units

Unit Tracked by (October 2026 review)
F-W20260729-OPS-01 #110 · #111 · #558 · #566 · #702 · #704 · #748
F-W20260729-OPS-02, F-W20260729-OPS-03, F-W20260729-OPS-04, F-W20260729-OPS-05, F-W20260729-OPS-06, F-W20260729-OPS-15, F-W20260729-OPS-16, F-W20260729-OPS-19 #114 · #303 · #423 · #465 · #533 · #558 · #566 · #607 · #638 · #668 · #686 · #702 · #776 · #795

Blocked by

#889 — the standard this step is reviewed against; write it first.

Decisions this step executes

  • C-12 — wheel testing: keep the source suite and add a wheel-contract step.
  • C-13 — the release-record check exempts PEP 440 pre-releases; tag ↔ version and ancestry are still enforced for every tag.
  • C-14 — publishing is gated on a supply-chain scan.

Plan

  • Add a wheel-contract step run from outside the checkout, mirroring the nightly's wheel-install-smoke.
  • Add a supply-chain-gate job that runs the nightly's two helpers against the tagged SHA.
  • Local verification is impossible for four criteria: use a scratch branch and throwaway v0.0.0-test-* tags per rejection case plus a deliberately broken wheel; then restore, re-tag green, delete every throwaway tag from the remote and confirm no [X.Y.Z] heading was left in CHANGELOG.md.

Exit criteria

  • Omitting a package-data glob turns the matrix red at the wheel-contract step while pytest tests/ stays green.
  • A mismatched, off-main or record-less tag cannot reach build.
  • A tagged SHA with an unsuppressed pip-audit finding cannot reach publish; a clean one leaves a retained artefact referencing that SHA.
  • Every referable BOM object has a globally unique bom-ref, validated against the official CycloneDX schema plus the semantic checks the schema cannot express.
  • The exact documented command downloads all SBOMs for a real released tag.
  • A policy guard rejects any non-local uses: that is not a full 40-character SHA.
  • A meta-test compares documentation claims against the workflow trigger inventory, so no document can claim enforcement CI does not perform.

How to deliver

  • One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
  • A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
  • Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
  • A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
  • Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.

Lenguaje dominante
Python
Estrellas
9
Forks
1
Merge medio
8 h 10 min
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de HodeTech/ForgeLM

Todos los issues de HodeTech/ForgeLM

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.