Skip to content

Release Checklist

Jump to bottom
Jm Rohmer edited this page Jul 5, 2026 · 2 revisions

Release Checklist

Use this page as the high-level release gate. The repository file docs/release-checklist.md remains the source of truth for the exact command list.

Local Verification

Run from the repository root:

gofmt -w <changed-go-files>
go test ./...
go test -race ./...
go vet ./...
staticcheck ./...
govulncheck ./...
gitleaks detect --no-banner --redact --source .
go run ./cmd/check-changelog -version <tag>
make check-changelog RELEASE_VERSION=<tag>
go test ./... -coverprofile=coverage.out
go tool cover -func=coverage.out | tail -n 1

CI threshold stays intentionally lower than the desired real coverage buffer. Do not raise or lower the CI threshold as a substitute for meaningful tests.

Live Agent Interop Gate

After staging or production deploy:

SMOKE_LIVE=1 ./scripts/check-agent-ready.sh
SMOKE_LIVE=1 ./scripts/smoke-agent-interop.sh

Then scan:

https://isitagentready.com/www.arleo.eu

Expected:

  • Overall score: 100 when reachable and fully compatible.
  • API/Auth/MCP/Skill Discovery: 7/7.
  • Auth.md agent registration: pass.

Before Tagging

Do not tag if:

  • secret scans fail;
  • CodeQL has open alerts for the release commit;
  • CHANGELOG.md does not contain the release tag;
  • anonymous clients can see write/admin tools;
  • admin clients only see anonymous/read tools;
  • auth.md lacks agent_auth_metadata;
  • identity_assertion.credential_types_supported is missing;
  • /.well-known/oauth-authorization-server or protected resource metadata returns 404;
  • Cloudflare is serving stale discovery files.

After Deploy

Verify:

curl -sk https://www.arleo.eu/auth.md | grep -E 'agent_auth_metadata|identity_assertion|credential_types_supported'
curl -sk https://mcp.arleo.eu/auth.md | grep -E 'agent_auth_metadata|identity_assertion|credential_types_supported'
curl -sk https://mcp.arleo.eu/.well-known/oauth-authorization-server | jq .
curl -sk https://mcp.arleo.eu/.well-known/oauth-protected-resource | jq .
curl -sk https://mcp.arleo.eu/.well-known/mcp/server-card.json | jq .

Documentation Updates

When a release changes public discovery, OAuth behavior, scopes, or tool exposure, update:

  • README.md
  • docs/tools.md
  • docs/operator-guide.md
  • docs/client-compatibility.md
  • this wiki if operator behavior changes

Security Reminder

Release notes must not contain:

  • OAuth client secrets
  • bearer tokens
  • authorization codes
  • Cloudflare tokens
  • private cookies
  • unredacted host-local config files

Clone this wiki locally