Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

[Phase 16] S12 — Release DAG and release-time evidence

Đang mở
  • Có gì không ổn?
#898 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
8/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
github-actions, python
Lĩnh vực
build-system, devops, release, security

Hướng nghiên cứu

Start with the step plan in docs/roadmap/phase-16-trust-surface-hardening.md (lines 636-680) and the release workflow it describes, and note that #889 must land first as the review standard. The issue spans many units and needs throwaway-tag verification on a scratch branch, so it is not a first task. Done means the listed exit criteria pass: the wheel-contract step fails on a missing package-data glob while pytest tests/ stays green, and a supply-chain gate blocks publish.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

phase: 16 source: roadmap

Roadmap · Phase 16, step S12 · size XL · 9 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:636-680

Summary

Every unit is a defect in the release DAG or in the evidence that DAG should produce, and they share one blast radius: they can only be verified by pushing throwaway tags. Zero lines of the wheel's Python modules execute in any of the twelve release-matrix cells — tests/__init__.py plus pytest's default prepend import mode put the checkout ahead of site-packages — and the SBOM step is metadata-only. What the matrix really gates (wheel build, metadata validity, twine check, cross-platform dependency resolution) is kept.

Units

Unit Tracked by (October 2026 review)
F-W20260729-OPS-01 #110 · #111 · #558 · #566 · #702 · #704 · #748
F-W20260729-OPS-02, F-W20260729-OPS-03, F-W20260729-OPS-04, F-W20260729-OPS-05, F-W20260729-OPS-06, F-W20260729-OPS-15, F-W20260729-OPS-16, F-W20260729-OPS-19 #114 · #303 · #423 · #465 · #533 · #558 · #566 · #607 · #638 · #668 · #686 · #702 · #776 · #795

Blocked by

#889 — the standard this step is reviewed against; write it first.

Decisions this step executes

  • C-12 — wheel testing: keep the source suite and add a wheel-contract step.
  • C-13 — the release-record check exempts PEP 440 pre-releases; tag ↔ version and ancestry are still enforced for every tag.
  • C-14 — publishing is gated on a supply-chain scan.

Plan

  • Add a wheel-contract step run from outside the checkout, mirroring the nightly's wheel-install-smoke.
  • Add a supply-chain-gate job that runs the nightly's two helpers against the tagged SHA.
  • Local verification is impossible for four criteria: use a scratch branch and throwaway v0.0.0-test-* tags per rejection case plus a deliberately broken wheel; then restore, re-tag green, delete every throwaway tag from the remote and confirm no [X.Y.Z] heading was left in CHANGELOG.md.

Exit criteria

  • Omitting a package-data glob turns the matrix red at the wheel-contract step while pytest tests/ stays green.
  • A mismatched, off-main or record-less tag cannot reach build.
  • A tagged SHA with an unsuppressed pip-audit finding cannot reach publish; a clean one leaves a retained artefact referencing that SHA.
  • Every referable BOM object has a globally unique bom-ref, validated against the official CycloneDX schema plus the semantic checks the schema cannot express.
  • The exact documented command downloads all SBOMs for a real released tag.
  • A policy guard rejects any non-local uses: that is not a full 40-character SHA.
  • A meta-test compares documentation claims against the workflow trigger inventory, so no document can claim enforcement CI does not perform.

How to deliver

  • One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
  • A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
  • Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
  • A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
  • Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.

Ngôn ngữ chính
Python
Star
9
Fork
1
Merge trung bình
8 giờ 10 phút
Pull request đã merge (30 ngày)
5

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của HodeTech/ForgeLM

Tất cả issue của HodeTech/ForgeLM

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.