fix: #66 recovery dispatch for stranded releases; SBOMs to per-crate releases - #67
Merged
Conversation
…releases Defect 1: publish.yml uploaded SBOMs to a release at the umbrella tag, which phase 1 never creates — only the per-crate releases exist. The SBOMs now attach per-crate, which is also the honest shape: each SBOM describes exactly one crate's dependency closure. Defect 2: release-plz refuses to tag unless the current commit is a release-PR merge commit, so any defect fixed after the release PR merges strands the release — manifests bumped, nothing tagged, nothing published, phase 1 a no-op. release-plz.yml gains a workflow_dispatch job that creates the six per-crate tags and releases directly at the head of main, guarded by the same unpublished-and-untagged checks as the umbrella step, then pushes the umbrella tag through the existing script unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closed
This was referenced Jul 31, 2026
Closed
Merged
CarlAllenn
added a commit
that referenced
this pull request
Jul 31, 2026
* chore: release v1.0.2 Hand-authored bump (release-plz opens no PR for CI-only changes): no library changes — this version exists to ship through the fully hardened release pipeline from #66/#67/#69, producing the first release with in-run provenance self-verification, a single attestation set, and SBOMs attached to the per-crate releases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: fuzz workspace lockfile follows edtf-core 1.0.2 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 31, 2026
Merged
Merged
Merged
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the two remaining publish-path defects from #66.
Defect 1 — SBOM upload targeted a release that never exists. publish.yml finished with
gh release upload "${GITHUB_REF_NAME}" …, but phase 1 creates only per-crate releases — there is no release at the umbrella tag. SBOMs now attach to the per-crate releases viaupload-sboms.sh, which is also the honest shape: each SBOM describes exactly one crate's dependency closure.Defect 2 — a fix landing after the release PR merges could not be released. release-plz refuses to tag unless the current commit is a release-PR merge commit, so a defect found after merge stranded the release (bumped manifests, nothing tagged, nothing published, phase 1 a no-op). release-plz.yml gains a
workflow_dispatchjob (tag-dispatch) that runstag-release.sh: from main only, it creates the six per-crate tags and GitHub releases at the current commit — refusing if the version is already on crates.io or the umbrella tag already exists — then pushes the umbrella tag through the existingpush-umbrella-tag.shunchanged, which triggers publish.yml as usual.Release notes for the dispatch path are extracted from each crate's changelog section for the version, with a plain fallback for crates whose bump came only from the version group.
Idempotent: a partial dispatch run (tags created, releases missing, umbrella absent) converges on re-dispatch.
The existing
release-prandtagjobs are gated topushevents; the stale "five per-crate tags" comment now says six.Closes #66's two defect checkboxes; the release itself follows via dispatch once this merges.
🤖 Generated with Claude Code