[Phase 16] S12 — Release DAG and release-time evidence
まだ誰も着手していません。
評価
- 難易度
- 5/5
- 見積もり時間
- 1週間以上
- 初心者へのやさしさ
- 8/100
- issue の種類
- バグ
- 明瞭さ
- おおむね明確
- 活発さ
- 活発
- 技術スタック
- github-actions, python
- 領域
- build-system, devops, release, security
調査の方向性
Start with the step plan in docs/roadmap/phase-16-trust-surface-hardening.md (lines 636-680) and the release workflow it describes, and note that #889 must land first as the review standard. The issue spans many units and needs throwaway-tag verification on a scratch branch, so it is not a first task. Done means the listed exit criteria pass: the wheel-contract step fails on a missing package-data glob while pytest tests/ stays green, and a supply-chain gate blocks publish.
索引モデルが issue の本文から書いたものです。
説明
Roadmap · Phase 16, step S12 · size XL · 9 unit(s) · planned in
docs/roadmap/phase-16-trust-surface-hardening.md:636-680
Summary
Every unit is a defect in the release DAG or in the evidence that DAG should produce, and they share one blast radius: they can only be verified by pushing throwaway tags. Zero lines of the wheel's Python modules execute in any of the twelve release-matrix cells — tests/__init__.py plus pytest's default prepend import mode put the checkout ahead of site-packages — and the SBOM step is metadata-only. What the matrix really gates (wheel build, metadata validity, twine check, cross-platform dependency resolution) is kept.
Units
| Unit | Tracked by (October 2026 review) |
|---|---|
F-W20260729-OPS-01 |
#110 · #111 · #558 · #566 · #702 · #704 · #748 |
F-W20260729-OPS-02, F-W20260729-OPS-03, F-W20260729-OPS-04, F-W20260729-OPS-05, F-W20260729-OPS-06, F-W20260729-OPS-15, F-W20260729-OPS-16, F-W20260729-OPS-19 |
#114 · #303 · #423 · #465 · #533 · #558 · #566 · #607 · #638 · #668 · #686 · #702 · #776 · #795 |
Blocked by
#889 — the standard this step is reviewed against; write it first.
Decisions this step executes
- C-12 — wheel testing: keep the source suite and add a wheel-contract step.
- C-13 — the release-record check exempts PEP 440 pre-releases; tag ↔ version and ancestry are still enforced for every tag.
- C-14 — publishing is gated on a supply-chain scan.
Plan
- Add a
wheel-contractstep run from outside the checkout, mirroring the nightly'swheel-install-smoke. - Add a
supply-chain-gatejob that runs the nightly's two helpers against the tagged SHA. - Local verification is impossible for four criteria: use a scratch branch and throwaway
v0.0.0-test-*tags per rejection case plus a deliberately broken wheel; then restore, re-tag green, delete every throwaway tag from the remote and confirm no[X.Y.Z]heading was left inCHANGELOG.md.
Exit criteria
- Omitting a package-data glob turns the matrix red at the wheel-contract step while
pytest tests/stays green. - A mismatched, off-main or record-less tag cannot reach
build. - A tagged SHA with an unsuppressed
pip-auditfinding cannot reachpublish; a clean one leaves a retained artefact referencing that SHA. - Every referable BOM object has a globally unique
bom-ref, validated against the official CycloneDX schema plus the semantic checks the schema cannot express. - The exact documented command downloads all SBOMs for a real released tag.
- A policy guard rejects any non-local
uses:that is not a full 40-character SHA. - A meta-test compares documentation claims against the workflow trigger inventory, so no document can claim enforcement CI does not perform.
How to deliver
- One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
- A reproducer that is red before the fix and green after; the full gauntlet from
CLAUDE.mdpasses under./.venv/bin/python. - Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
- A step that grows a deferred module carries its
budget_historyjustification in the same diff; a widened guard rolls out non-strict first, then flips. - Commit bodies cite
Absorbs F-W20260729-…; the CHANGELOG[Unreleased]section gets an entry only for a change a user or library consumer can observe (decision C-20).
Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.
- 主要言語
- Python
- スター
- 9
- フォーク
- 1
- 平均マージ
- 8時間 10分
- マージ済み PR（30日）
- 5
環境構築
- Dockerfile または Docker Compose ファイルあり
- プルリクエストのテンプレートあり
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
HodeTech/ForgeLM のほかの issue
-
area: dev-tooling bug severity: low source: roadmap wave: 4
難易度 2/5 1〜3時間 初心者へのやさしさ 70/100
-
area: site bug good first issue severity: low source: review-2026-09 wave: 4
難易度 2/5 1〜3時間 初心者へのやさしさ 66/100
-
documentation good first issue severity: medium source: review-2026-09 wave: 3
難易度 2/5 1〜3時間 初心者へのやさしさ 75/100
-
documentation good first issue severity: low source: review-2026-09 wave: 4
難易度 1/5 1〜3時間 初心者へのやさしさ 80/100
-
documentation severity: medium source: review-2026-09 wave: 3
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
HodeTech/ForgeLM の issue をすべて見る
似ている issue
-
effort: low prio: low ready
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
digitalfabrik/integreat-cms#4616 ·
メンテナーはふだん 5 日以内に返信
-
bug difficulty:2 good first issue help wanted
難易度 2/5 1〜3時間 初心者へのやさしさ 88/100
MakazhanAlpamys/Soup#1865 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
FinanceFlash/unvibecode#233 ·
メンテナーはふだん 1 日以内に返信
-
area: agents area: docs good first issue
難易度 2/5 1〜3時間 初心者へのやさしさ 88/100
openapi/gknowledge#23 ·
-
useless-suppression reported for deprecated-* messages that should be exempt対応中かも @adityasinha-ghub が今日担当しました。 オープン
難易度 2/5 1〜3時間 初心者へのやさしさ 88/100
pylint-dev/pylint#11656 ·
メンテナーはふだん 1 日以内に返信