Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

[Phase 16] S12 — Release DAG and release-time evidence

未关闭
  • 哪里不对？
#898 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
8/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
github-actions, python
领域
build-system, devops, release, security

调研方向

Start with the step plan in docs/roadmap/phase-16-trust-surface-hardening.md (lines 636-680) and the release workflow it describes, and note that #889 must land first as the review standard. The issue spans many units and needs throwaway-tag verification on a scratch branch, so it is not a first task. Done means the listed exit criteria pass: the wheel-contract step fails on a missing package-data glob while pytest tests/ stays green, and a supply-chain gate blocks publish.

由索引模型根据 Issue 内容生成。

描述

phase: 16 source: roadmap

Roadmap · Phase 16, step S12 · size XL · 9 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:636-680

Summary

Every unit is a defect in the release DAG or in the evidence that DAG should produce, and they share one blast radius: they can only be verified by pushing throwaway tags. Zero lines of the wheel's Python modules execute in any of the twelve release-matrix cells — tests/__init__.py plus pytest's default prepend import mode put the checkout ahead of site-packages — and the SBOM step is metadata-only. What the matrix really gates (wheel build, metadata validity, twine check, cross-platform dependency resolution) is kept.

Units

Unit Tracked by (October 2026 review)
F-W20260729-OPS-01 #110 · #111 · #558 · #566 · #702 · #704 · #748
F-W20260729-OPS-02, F-W20260729-OPS-03, F-W20260729-OPS-04, F-W20260729-OPS-05, F-W20260729-OPS-06, F-W20260729-OPS-15, F-W20260729-OPS-16, F-W20260729-OPS-19 #114 · #303 · #423 · #465 · #533 · #558 · #566 · #607 · #638 · #668 · #686 · #702 · #776 · #795

Blocked by

#889 — the standard this step is reviewed against; write it first.

Decisions this step executes

  • C-12 — wheel testing: keep the source suite and add a wheel-contract step.
  • C-13 — the release-record check exempts PEP 440 pre-releases; tag ↔ version and ancestry are still enforced for every tag.
  • C-14 — publishing is gated on a supply-chain scan.

Plan

  • Add a wheel-contract step run from outside the checkout, mirroring the nightly's wheel-install-smoke.
  • Add a supply-chain-gate job that runs the nightly's two helpers against the tagged SHA.
  • Local verification is impossible for four criteria: use a scratch branch and throwaway v0.0.0-test-* tags per rejection case plus a deliberately broken wheel; then restore, re-tag green, delete every throwaway tag from the remote and confirm no [X.Y.Z] heading was left in CHANGELOG.md.

Exit criteria

  • Omitting a package-data glob turns the matrix red at the wheel-contract step while pytest tests/ stays green.
  • A mismatched, off-main or record-less tag cannot reach build.
  • A tagged SHA with an unsuppressed pip-audit finding cannot reach publish; a clean one leaves a retained artefact referencing that SHA.
  • Every referable BOM object has a globally unique bom-ref, validated against the official CycloneDX schema plus the semantic checks the schema cannot express.
  • The exact documented command downloads all SBOMs for a real released tag.
  • A policy guard rejects any non-local uses: that is not a full 40-character SHA.
  • A meta-test compares documentation claims against the workflow trigger inventory, so no document can claim enforcement CI does not perform.

How to deliver

  • One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
  • A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
  • Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
  • A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
  • Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.

主要语言
Python
星标
9
派生
1
平均合并
10 小时 40 分钟
30 天内合并 PR
12

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

HodeTech/ForgeLM 的其他 Issue

查看 HodeTech/ForgeLM 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。