Use the existing nextest, doctest, and lockfile gates on the Ubuntu matrix leg for heavy pull requests regardless of branch prefix. Keep CNB as the non-PR Linux path and assert the workflow contract for #5547.
Promotes the fully gated non-benchmark candidate while preserving the benchmark tree exactly from the prior release-PR head.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Stop invoking deleted brittle harnesses, drop the retired PTY nextest target, and preserve Agent Mail error and redaction behavior without duplicate branches.
Signed-off-by: Hunter Bown <hmbown@gmail.com>
Pin the measured 10/15/90 minute release-lane ceilings, exercise the timeout parser itself, and document the last-useful-log recovery rule for 404 or stalled runner logs.
Signed-off-by: Hunter Bown <hmbown@gmail.com>
Seal intentional config fixtures, isolate unsealed config/state/skills paths from the developer home, serialize persistent-service cases under nextest and libtest, and give the PDF success path a realistic timeout while retaining its short timeout regression.
Also treat removed or empty home variables as unsealed so tests cannot fall back into the user profile.
Verified with 477 config tests, 7 test-support tests, 27 config-persistence tests, 12 provider-key tests, 5 PDF tests, 3 nextest and 3 libtest persistent-service tests, workflow wiring checks, formatting, and diff checks.
Signed-off-by: Hunter Bown <hmbown@gmail.com>
#5495 capped `ci.yml`; the release path was left on GitHub's 360-minute
default. That is not theoretical — the v0.9.9 train had an assigned-but-dead
runner sit `in_progress` with 404 logs, and the operator rule (cancel/rerun
after 20 minutes of 404s) only limits damage while somebody is watching.
Twenty jobs were uncapped: all of `release-candidate.yml`,
`release-artifacts.yml`, `release.yml`, and `release-republish.yml`. Caps use
the four values agreed in the issue (candidate resolve 10, candidate web 15,
artifact build 90, and 15 each for bundle / windows-installer / assemble /
smoke) and size the rest against observed healthy durations with margin.
Jobs that call a reusable workflow are deliberately left alone: GitHub rejects
`timeout-minutes` on a `uses:` job, which is exactly why the artifact bounds
belong in `release-artifacts.yml` rather than in its callers.
The acceptance criterion asked for a test that fails when a new uncapped
release job appears, so the guard lands with the thing it guards. It walks each
workflow's job headers, skips `uses:` jobs, and requires an explicit
`timeout-minutes` — and it immediately found a job the manual pass missed,
`nightly.yml`'s `build`, now capped at 90 minutes alongside the artifact build.
It also asserts the artifact build keeps at least 60 minutes, because a tight
cap there would fail healthy Windows builds that historically run 40-45.
Timeouts are containment, not recovery: the runbook keeps the 404-log
cancel/rerun rule for infrastructure failures.
Verified: `node .github/scripts/release-workflows.test.js` passes; re-run with
an uncapped job spliced into release.yml it fails with
"release.yml: every job must set timeout-minutes (#5496)". All six workflows
still parse as YAML with their job counts unchanged.
Bind the CNB tag build to the checked-out commit before compiling and fail if CNB's advertised commit disagrees. Keep the release notes on the same verified identity and lock the ordering in the workflow contract test.
No-Issue: owner-directed v0.9.9 CNB release identity gate
All 19 open actions/cache-poisoning/poisonable-step alerts (#88-#106) sit in
release.yml, release-candidate.yml and release-artifacts.yml: jobs interpolated
the caller SHA into ref/caches and let setup-node's implicit npm cache key on
run identity. Now caller source_sha is pinned against github.sha by a pin job
(refusing any retarget), checkout and build identity use GITHUB_SHA through
env indirection instead of template interpolation, rust-cache keys use stable
prefix-key values, and setup-node's implicit package cache is off where it
cannot be keyed safely.
Also carries the CodeQL #107 fix from the same lane: catalog_models_dev.py
prints remote limit values as numbers/null/redacted only and drops query and
fragment material from source URLs before logging.
Harvested from #5401 (workflow+script files; CHANGELOG edit intentionally
excluded here and lands with the release branch; GHSA advisory text split to
a later PR as advised).
No-Issue: CodeQL alert remediation (alerts #88-#107); no single user-facing issue tracks these
Signed-off-by: Hunter Bown <hunter@hmbown.com>
brew tap Hmbown/deepseek-tui && brew install codewhale is the install
path. The legacy deepseek-tui formula stays a deprecated alias for one
overlap release. TAP_REPO is unchanged.
Run the recovery implementation from the protected default branch instead of restoring the old release commit that may contain the bug being repaired.
Keep release bytes pinned to the resolved tag and checksum manifest, and lock the split with workflow contract tests.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Derive archive mtimes from the pinned source commit in release artifacts, retain reproducible archive bytes and executable modes, and cover metadata plus input validation.
Bind npm publication to the exact release SHA after the public asset freshness gate, without a long-lived registry token. Document the npm-side publisher binding and interactive 2FA recovery path.\n\nCloses #5299
Three v0.9.5 benchmark tasks could not launch Codewhale at all:
mteb-leaderboard, mteb-retrieve, and pytorch-model-recovery run older ARM64
images, and the aarch64-unknown-linux-gnu artifact built on ubuntu-24.04-arm
requires GLIBC_2.39.
Release and nightly now build aarch64-unknown-linux-musl on the native ARM
runner, alongside the x64 musl build that has shipped since v0.8.65. Both
gain a static check (no ELF INTERP) plus a launch smoke on the matching
native runner, so a dynamically linked or non-starting binary fails the
build rather than the user's install. docs/INSTALL.md drops the arm64 glibc
floor section and describes the v0.9.6 matrix.
Also reconciles the copy the earlier commits invalidated: setup ratification
text and all 15 locales stop attributing execution doctrine to "mode
prompts", docs/MODES.md states Auto-Review's actual deterministic
allow/deny behavior, and the source-structure, dead-code, and
runtime-contract budgets are re-measured — the last locking down 25
decreased ceilings and the new mode-agnostic prompt-stage digests.
Run the isolated Skills Manager scenario through the pty integration-test binary and use its module-qualified name so --exact executes one test instead of zero. Lock the command into the workflow contract and update the durable TUI verification examples.
Verified with the exact ignored PTY command, the workflow contract test, actionlint YAML/expression checks, and git diff --check.
Keep provider-neutral auto selection in the provider-aware TUI and launch workflow lanes from the exact running executable. Repair CNB and installer alias contracts, refresh legacy website-installed TUI bytes during upgrades, and make account pull reject an unimplemented local import truthfully.\n\nVerified with focused CLI/config tests, strict Clippy, workflow contracts, shell syntax checks, and hermetic web installer tests.
Build only the codewhale executable, then stage codewhale and codew from the same bytes for every retained nightly target. Native jobs smoke only the executable that Cargo actually produced, while tagged-release TUI bridge filenames remain out of the nightly command contract.\n\nExtend the workflow contract test to lock the six-target, twelve-artifact inventory, byte-identity check, native smoke selection, and 14-day retention.
Build codewhale once, expose the verified bytes as codew across release channels, and retain seven TUI-named release aliases solely so shipped v0.9.4 clients can discover and cross the transition. Current installers and containers expose only codewhale and codew.\n\nVerified with the npm asset suite, exact 34-asset assembly, workflow contract, Homebrew renderer, release-body, dogfood installer, and shell syntax tests.\n\nRefs #5259
Repair the command escaping helper so future metacharacters cannot weaken the workflow contract, and remove the redundant installer path branch.
Signed-off-by: Hunter B <hmbown@gmail.com>
Resolve each remote Action used by candidate artifact construction or public publication to the current audited commit, retaining the release version as an update hint.\n\nAdd a contract test that rejects mutable remote refs in all three release workflows and clean up the affected shell blocks so configured actionlint remains green.
Signed-off-by: Hunter B <hmbown@gmail.com>
Checkout the resolved candidate SHA in a dedicated read-only web job and require public facts, docs, tests, lint, type checking, and the production build before constructing any release artifacts.\n\nKeep the candidate workflow non-publishing and bind artifact creation to the web gate result.
Signed-off-by: Hunter B <hmbown@gmail.com>
Fail before build work and again immediately before upload whenever a tag already owns GitHub Release assets. Disable the release action overwrite path and document that recovery requires a deliberate maintainer decision instead of silently replacing public bytes.
Signed-off-by: Hunter B <hmbown@gmail.com>
Factor the seven-target release build and 34-file asset assembly into a read-only reusable workflow shared by public releases and a manual non-publishing candidate path. Manual CI now validates the requested SHA and runs the full Linux, macOS, Windows, npm, mobile, workflow, Actions, and docs gates instead of light placeholders.
Add checksum/inventory contracts, archive fixtures, packaged-wrapper smoke against assembled assets, and an explicit publication stop line in the release runbook.
Signed-off-by: Hunter B <hmbown@gmail.com>
Retire the v0.8.68 label-to-milestone synchronizer now that milestone 53 is historical. Keep area-hint labeling only for newly opened agent-ready tasks and require maintainers to assign roadmap milestones explicitly.\n\nMake the issue form version-neutral, document the historical boundary, and add a CI contract that rejects release-pinned defaults or milestone mutation APIs.
Generate current provider-neutral formula copy, install and smoke codew alongside codewhale and codewhale-tui, and exercise the rendered formula contract in always-on CI.
The formula downloaded deepseek-macos-arm64 (the deprecation shim) as the
main binary. After the rebranding, deepseek is just a wrapper that spawns
codewhale, but codewhale was never installed — causing "codewhale not
found on PATH" for every Homebrew user.
Now the formula downloads codewhale-* as the primary binary and installs
all four artifacts: codewhale, codewhale-tui, deepseek (legacy shim), and
deepseek-tui (legacy TUI shim).
Closes#2104
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Add a release follow-up job that updates the Homebrew tap from the checksum manifest when a tap token is configured.
The job now skips before checkout/download/update when neither HOMEBREW_TAP_PAT nor RELEASE_TAG_PAT is configured, so missing tap credentials do not fail an otherwise successful release.
Closes#1602.
Co-authored-by: Zhiping <2716057626@qq.com>
Co-authored-by: Oliver-ZPLiu <47081637+Oliver-ZPLiu@users.noreply.github.com>
Isabel Wu