Derive archive mtimes from the pinned source commit in release artifacts, retain reproducible archive bytes and executable modes, and cover metadata plus input validation.
`scripts/release/verify-workspace-version.sh` had zero references anywhere:
no workflow under `.github/workflows/`, no `.cnb.yml` job, no runbook
(`docs/RELEASE_RUNBOOK.md`, `docs/RELEASE_CHECKLIST.md`), no other script,
and no entry in the private ops repo. A repo-wide ripgrep across all file
types (hidden files included, `target/` excluded) matched only the file's
own path.
Its job is fully subsumed by two gates that are wired in:
- `require-release-tag-checkout.sh:9-30` refuses to publish unless HEAD is
exactly `refs/tags/v<workspace_version>` on a clean tree, which is the
tag-vs-workspace agreement this script re-derived from `GITHUB_REF`.
- `check-versions.sh` check #1 forbids literal per-crate `version =` values,
so `cargo metadata` versions cannot diverge from the workspace version in
the first place.
Proof: `bash scripts/release/check-versions.sh && bash scripts/release/require-release-tag-checkout.test.sh`
Result: pass — "Version state OK: workspace=0.9.6, npm=0.9.6, lockfile in
sync." then "Release checkout gate OK: clean v0.9.6 at 3815bd705." and
"require-release-tag-checkout tests passed" (exit 0).
Implemented with Claude Code agent assistance.
Keep provider-neutral auto selection in the provider-aware TUI and launch workflow lanes from the exact running executable. Repair CNB and installer alias contracts, refresh legacy website-installed TUI bytes during upgrades, and make account pull reject an unimplemented local import truthfully.\n\nVerified with focused CLI/config tests, strict Clippy, workflow contracts, shell syntax checks, and hermetic web installer tests.
The npm wrapper exposes codewhale and codew, while v0.9.5 keeps codewhale-tui only as legacy asset filenames for old updater compatibility. Stop npx from resolving a nonexistent codewhale-tui package during the release smoke and make the runbook describe the single compiled runtime accurately.
Verified with the full local npm wrapper smoke against the exact 0.9.5 release binary, node syntax checking, and the website documentation contract.
Release preparation now updates the runtime SDK and VS Code extension manifests and locks alongside the Rust and npm wrapper versions. The normal version gate checks the same records that the tag workflow requires, and the transactional fixture proves the expanded bump and rollback set.
Build codewhale once, expose the verified bytes as codew across release channels, and retain seven TUI-named release aliases solely so shipped v0.9.4 clients can discover and cross the transition. Current installers and containers expose only codewhale and codew.\n\nVerified with the npm asset suite, exact 34-asset assembly, workflow contract, Homebrew renderer, release-body, dogfood installer, and shell syntax tests.\n\nRefs #5259
Closes#5245 groundwork (issue stays open until the acceptance run is on
CI). Every local git commit invalidated codewhale-tui (620 files) and
codewhale-cli because their build scripts watched .git/HEAD and the branch
ref to keep the --version sha fresh — a ~14-minute fat-LTO rebuild per
commit with zero code changes.
The stamp is now environment-only: DEEPSEEK_BUILD_SHA (wins) or GITHUB_SHA
suffix the version and set CODEWHALE_BUILD_COMMIT; build scripts declare
only rerun-if-env-changed for those two variables and never touch .git. An
unstamped local build renders '0.9.4 (dev)'. Runtime git resolution was
rejected deliberately: the binary runs inside users' repositories, and a
stale binary reporting the checkout's current HEAD would break the
dogfood-receipt identity install-dogfood.sh verifies — the module doc
records this reasoning. CI is byte-identical (GITHUB_SHA was already set);
install-dogfood.sh now prints the stamped build command in both of its
refusal paths. declare_git_head_rerun and the git fallback are deleted;
CODEWHALE_RELEASE_BUILD_SHA semantics are untouched.
Verified: cargo test -p codewhale-build-support green (new env-only
contract test); cargo build -p codewhale-tui -p codewhale-cli, then
git commit --allow-empty + rebuild -> zero 'Compiling codewhale' lines,
Finished in 0.17s. All CODEWHALE_BUILD_COMMIT consumers already use
option_env!. Authored with agent assistance (Claude); spec by the owner's
build-time lane (#5245/#5249).
cmd's %* expansion strips the quotes rustc puts around link arguments that
contain spaces, so an SDK path like "D:\DevEco Studio\...\sysroot" arrived at
the clang launcher split on the space and the final Rust link failed. Walk the
arguments with %~1 and re-wrap each in quotes before forwarding to the
PowerShell wrapper, and extend the no-SDK release guard to keep the re-quoting
contract.
Assisted by Claude Code.
Signed-off-by: shenjackyuanjie <54507071+shenjackyuanjie@users.noreply.github.com>
(cherry picked from commit 6a3837cd48dc937bfaff6288750ac79f7f9cd2fd)
Pass CARGO_TARGET_DIR through the npm wrapper smoke asset preparation path so release validation consumes the exact binaries built in isolated target directories.
Add codewhale-paths to the crates.io dependency order before the crates that consume it. The v0.9.3 packaging dry-run correctly caught that the new workspace member was otherwise omitted.
Accept the current generic install documentation while continuing to validate and update legacy numeric snippets when present. Keep the root npm lock, remote-smoke default, and source-candidate facts in the same release transaction without changing published-release provenance.\n\nBack up every release-bearing file before mutation and restore the exact starting bytes if refresh or validation fails. Extend the fixture suite across generic docs, legacy forms, selective fact updates, and forced downstream rollback.
macOS ad-hoc signing may rewrite binary bytes after installation, so a fresh-shell hash cannot equal the pre-sign build hash. Require resolution from an explicit install destination, verify the embedded current HEAD, and record both source and installed hashes.
Build an HTTP/1.1 twin client and automatically retry stream opens when
H2 headers stall; update user-facing CODEWHALE_FORCE_HTTP1 copy. Dim and
lock unselectable models, explain on Enter, and hand off to provider
auth. Surface scout/fast routing as resolved-at-launch. Add cached git
status chrome and worktree data module. Expose sandbox_mode in settings
and ad-hoc re-sign self-built macOS dogfood installs after copy.
Accept the explicit unreleased-candidate heading during source CI while requiring a dated heading and tag compare link at publication time. Sync the packaged TUI changelog so it carries the same candidate wording and contributor credit as the root record.
Signed-off-by: Hunter B <hmbown@gmail.com>
Keep same-version release preparation on the canonical validation path, install and package the native codew shim, and make web and checksum verification reflect what operators actually run. Add focused release-helper, npm, and checksum contracts while leaving deploy and publication boundaries unchanged.
Signed-off-by: Hunter B <hmbown@gmail.com>
Repair the command escaping helper so future metacharacters cannot weaken the workflow contract, and remove the redundant installer path branch.
Signed-off-by: Hunter B <hmbown@gmail.com>
Fail before build work and again immediately before upload whenever a tag already owns GitHub Release assets. Disable the release action overwrite path and document that recovery requires a deliberate maintainer decision instead of silently replacing public bytes.
Signed-off-by: Hunter B <hmbown@gmail.com>
Restore the Unix executable contract after GitHub artifact transport normalizes files to 0644. Normalize archive metadata as well so identical inputs do not create packaging-only checksum drift, while retaining the separate public-asset immutability guard.
Signed-off-by: Hunter B <hmbown@gmail.com>
Factor the seven-target release build and 34-file asset assembly into a read-only reusable workflow shared by public releases and a manual non-publishing candidate path. Manual CI now validates the requested SHA and runs the full Linux, macOS, Windows, npm, mobile, workflow, Actions, and docs gates instead of light placeholders.
Add checksum/inventory contracts, archive fixtures, packaged-wrapper smoke against assembled assets, and an explicit publication stop line in the release runbook.
Signed-off-by: Hunter B <hmbown@gmail.com>
Build and smoke the complete Windows ARM64 binary family on GitHub native runners, wire npm, updater, bundle, website, and release inventory support, and preserve the originating contributor credit.
Move Linux ARM64 releases off the slower cross-link path, remove redundant matrix target installs, and update actionlint for the hosted ARM runner label.
Refs #4267.
Co-authored-by: w1w218 <6767665+w1w218@users.noreply.github.com>
Signed-off-by: Hunter B <hmbown@gmail.com>
Make the no-SDK contract check cover the normalized SDK path and both exit-code handoffs, from clang to PowerShell and from PowerShell to Cargo. Without these assertions the gate could stay green after breaking behavior that the HarmonyOS guide promises.
Signed-off-by: Hunter B <hmbown@gmail.com>
Point Cargo's Windows OHOS linker at a repository-local cmd launcher that delegates to the existing PowerShell clang wrapper. This keeps the target triple, SDK sysroot, and MUSL define on the final Rust link while preserving Cargo's arguments and the native linker exit status.
Extend the no-SDK release gate and documentation to protect the full linker and rquickjs bindgen contract. Follow-up evidence from @shenjackyuanjie's PR #4470 completes the Windows linker path alongside @shenyongqing's original bindgen approach in PR #4384.
Co-authored-by: shenjackyuanjie <54507071+shenjackyuanjie@users.noreply.github.com>
Signed-off-by: Hunter B <hmbown@gmail.com>
Extend check-ohos-deps.sh with a cargo-tree feature-graph assertion that
the OHOS target activates rquickjs's bindgen feature (forwarded to
rquickjs-sys) for codewhale-workflow-js — the only reason the crate
compiles for a target with no pre-generated QuickJS bindings. Pure
metadata: no SDK or target toolchain required. Positive path verified
against current main (bindgen landed in #4470); negative path verified
against a non-OHOS target.
Carried over from the #4459 review lane; the OHOS bindgen approach was
pioneered by @shenyongqing in #4384.
Signed-off-by: Hunter B <hmbown@gmail.com>
Allow the disposable bare remote to accept a tag from a depth-1 checkout. This keeps the release helper contract test hermetic under the Version drift job without requiring a full repository fetch.
Signed-off-by: Hunter B <hmbown@gmail.com>
Integrate the underwater TUI, message-first Operate, Fleet and Workflow reliability, expanded model/provider catalog, exact custom-route restoration, docs-first site, localization, packaging, and release metadata for the v0.9.0 candidate.
Harden endpoint-bound credential provenance, approval and goal UX, Fleet attempt fencing and crash recovery, large-workspace mention discovery, Kimi budgeting, and release asset/version gates. Include the stopship Fleet and Workflow fixtures used by release dogfood.
Verified with workspace fmt/check/clippy/tests on Rust 1.88, release-script and npm suites, 18-crate publish dry run, production web build, Docker build check, secret scan, dependency audit, and protected-state hash validation.
Keep the exact-tag safety fixture aligned with the workspace release version so it continues exercising clean checkout, branch-ahead, and moved-remote-tag failures after version bumps.
Treat the absence of version-pinned README install examples as a valid release state while continuing to update matching examples when present. Preflight every pinned README tag before any file writes so a stale example fails without leaving Cargo or npm metadata half-bumped.\n\nExercise the full helper in disposable fixtures for optional localized tags, matching-tag replacement, downstream completion, and atomic stale-tag rejection, and run that contract in CI.
Require exact-tag dispatches, immutable source checkouts, live tag revalidation before public writes, and stale-main-safe tag creation. Cargo and npm publication now fail closed unless the checkout is clean and matches the remote release tag, with moved-tag regression coverage and corrected operator sequencing.
Copy the codew shim into the GHCR image, smoke all three public binaries after push, and fail the GitHub Release if the container lane fails. Keep release copy on the canonical state volume and list the Android archive.
Move the final integration fixes into the dated release section, refresh the candidate ledger and crate inventory, and generate explicit community credits in the GitHub release body. Add a regression test for contributor-heading extraction.
Extract the Tasks, To-do, and worker ledger into an owned work-surface module with stable focus, scrolling, mouse actions, compact overflow, and safe cancellation. Keep Classic as the rollback shell while removing the migrated underwater strip from the legacy sidebar.
Make route billing distinguish metered API usage from OAuth, token-plan, and local routes; align direct startup, mode truth, slash-model performance, modal stack safety, hermetic tests, PTY gates, and atomic dogfood receipts.
The provider/model release-smoke matrix mapped `arcee ->
trinity-large-thinking`, but that id is Arcee's LARGE reasoning model (it is
DEFAULT_ARCEE_MODEL), the opposite of the cheap sentinel this matrix wants,
and app-server-smoke.test.sh expects arcee UNMAPPED — so the committed test
failed 3/18. Remove the arcee default so it is unmapped again (fails loud /
overridable via SMOKE_MODEL_ARCEE), which fixes the test and honors the
script's conservative "never guess a model id" design (#3205).
Also resolve a code/docs mismatch: the matrix only ships built-in cheap
defaults for a conservative subset (deepseek, zai, moonshot, openai) and
leaves openrouter, xiaomi-mimo, openai-codex, and arcee unmapped on purpose.
RUNTIME_API.md's "maps each to a cheap model" wording now states which
providers have built-in defaults and that the rest require SMOKE_MODEL_<SLUG>
overrides rather than a guessed id.
`bash scripts/release/app-server-smoke.test.sh` now passes all 18 checks.
codewhale-tui and codewhale-cli depend on codewhale-build-support as a
path+version build-dependency, and codewhale-tui depends on
codewhale-workflow-js the same way. Neither crate was in release_crates,
so cargo publish would fail on the dependents at release time. Add both
in dependency order.
`prepare-release.sh` and `check-versions.sh` only updated/guarded README
`--tag vX.Y.Z` examples, so the user-facing "verify your install" lines
(`codewhale --version # X.Y.Z`) and the docs/INSTALL.md npm-wrapper publish
pointer could go stale while the release gate still reported green. On the
0.8.66 candidate, docs/INSTALL.md still said 0.8.65 while check-versions passed.
- `prepare-release.sh` now bumps `codewhale --version # <version>` across
README*.md and docs/INSTALL.md, and the docs/INSTALL.md "wrapper is published
at vX.Y.Z" sentence (the v0.8.56 minimum-wrapper floor is preserved).
- `check-versions.sh` now fails when any of those snippets drift from the
workspace version. Narrowly scoped to those two snippet shapes to avoid
flagging unrelated historical prose ("as of vX").
Fixes#3767
The retry wrapper should never let CODEWHALE_OHOS_DEP_RETRIES=0 skip the cargo tree probe and pass an empty dependency graph. Reject invalid retry counts before probing so the guard fails loudly instead.
The Version drift gate can fail when Cargo registry fetches briefly drop during the OHOS dependency graph probe. The underlying check is still useful, but a transient EOF should not be indistinguishable from real dependency drift.
Retry cargo tree a few times before failing, while preserving the final nonzero status for real errors. Document the CI hardening in both changelogs.
Drain redirect responses in the npm release asset verifier before following them, and cap redirect recursion to match the existing HEAD helper.
Also clarify the 100-run workflow lookup window and add coverage for non-uploaded GitHub Release assets.
Add a release asset verification gate that compares the local and remote tag SHAs, confirms a successful Release workflow run for that SHA, and reruns the npm wrapper asset verifier against the public GitHub assets.
Strengthen npm release:check so stale or incomplete GitHub Release assets fail before publish, while local/mirror asset checks still work through explicit release-base overrides.
Document npm auth/OTP retry commands, final registry verification, and the legacy deepseek-tui no-republish rule.
Closes#2642.
Closes#2643.
Stage the codew binary in release builds, include it in platform archives and Windows installer inputs, and teach local release asset prep/checks about the shim. The Unix archive installer now installs via atomic replace so an existing executable is not overwritten in place.
CodeWhale Bot