release-train: staging -> main by LukasWodka · Pull Request #428 · tracebloc/cli

LukasWodka · 2026-07-29T09:59:30Z

Automated promotion by the release train (RFC-0008 D14). Head is the train-managed release-train/to-main branch (a mirror of staging), so it never collides with a human PR. Merged only when the fr-gate is green.

Note

Medium Risk
Changes release gating and mandatory cosign verification on install; a VERSION/tag mismatch blocks releases, and stricter identity regex could reject signatures if workflow OIDC identity ever diverges from tag refs.

Overview
Tightens release-train hygiene and installer cosign policy for the 0.10.1 promotion.

Adds a root VERSION file (0.10.1) and makes the release workflow fail the build when the tag’s base semver doesn’t match that file (old tags without VERSION only get a warning). GitHub Release prerelease is now computed strictly: only a plain vX.Y.Z tag is stable/latest; RCs and malformed tag shapes stay prerelease instead of relying on a hyphen in the tag name.

Cosign verify-blob identity in release.yml docs, install.sh, and install.ps1 is narrowed from release.yml@.* to release.yml@refs/tags/v.* so verification expects signatures tied to version tags, not arbitrary workflow refs.

^{Reviewed by Cursor Bugbot for commit c8d142d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…9) (#415) install.sh verified downloaded binaries against certificate-identity-regexp '.../release.yml@.*' — @.* matches ANY ref, so a binary signed by release.yml running on a feature branch verified identically to a tagged release. Anchor to '@refs/tags/v.*' so only tag-built releases are trusted. Same anchor applied to the documented verify command in release.yml. Part of tracebloc/backend#1269 (row 4). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…#417) * chore: declare next release in VERSION (0.10.1) for the release train The train reads this file to cut tags: vX.Y.Z-rc.N on every staging promotion (pre-release binaries for FR; 'latest' never sees them) and vX.Y.Z on the prod promotion. The binary's own version still derives from the tag at build time (release.yml ldflags) -- this file only declares intent, uniform with tracebloc-py-package's pyproject version. 0.10.1 ships the cosign identity anchor fix (#415). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(release): enforce tag==VERSION + strict prerelease detection Two guards raised in release-train review: (1) any tag's base X.Y.Z must match the VERSION file (train-cut or manual), so the file can never go silently stale after an out-of-train release; pre-VERSION tags are grandfathered for rebuilds. (2) STRICT stability: only plain vX.Y.Z is a stable release -- rc tags AND malformed variants (v1.2.3rc1, no dash) are prereleases, so 'releases/latest' (the installer bootstrap) can only ever resolve a real production build. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * style: quote GITHUB_OUTPUT redirects (shellcheck SC2086) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…415) (#422) install.sh rejects signatures from non-tag workflow runs; install.ps1 still accepted @.* -- Windows trusted what Unix refused. Same anchor now: refs/tags/v.* (covers rc tags too). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

release-train: develop -> staging

LukasWodka · 2026-07-29T09:59:31Z

bugbot run

LukasWodka · 2026-07-29T10:00:03Z

👋 Heads-up — Code review queue is at 43 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (feat(data ingest): wire the 5 text tasks (#182) #209) · author: @divyasinghds · no reviewer assigned
averaging-service#224 — chore: clear the ruff backlog (E4,E7,E9,F) · author: @LukasWodka · no reviewer assigned
averaging-service#225 — fix(averaging): fail fast + dead-letter on permission-denied weight write (fix(push): text preflight fails closed on a labels.csv read error #221) · author: @divyasinghds · no reviewer assigned
backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
backend#1321 — chore: clear house-rules findings · author: @LukasWodka · no reviewer assigned
backend#1322 — fix(errors): replace bare except clauses with scoped handling (#614) · author: @saqlainsyed007 · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

LukasWodka · 2026-07-29T10:02:15Z

bugbot run

) Cosign's keyless identity embeds the RUN's ref. workflow_dispatch took an inputs.ref and could build a tag from a branch run, publishing signatures (@refs/heads/...) that the tag-anchored installers reject on every customer machine. inputs.ref removed; dispatch runs now hard-fail unless started at a v* tag ref; rebuild paths = rerun the tag run or dispatch at the tag. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

LukasWodka · 2026-07-29T14:48:08Z

bugbot run

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c8d142d. Configure here.}

…egrity (#429) * fix(release): rebuilds must run at the tag ref (Bugbot on promotion #428) Cosign's keyless identity embeds the RUN's ref. workflow_dispatch took an inputs.ref and could build a tag from a branch run, publishing signatures (@refs/heads/...) that the tag-anchored installers reject on every customer machine. inputs.ref removed; dispatch runs now hard-fail unless started at a v* tag ref; rebuild paths = rerun the tag run or dispatch at the tag. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * review: pre-flight guard job + refs via env (Asad's nits on #429) Guard moved out of the 8-way matrix into a tiny job that release needs: a branch-misdispatch now fails once in seconds instead of burning eight runners' setup. Refs passed via env, never interpolated -- git permits $/backticks in tag names, so a crafted v* tag would otherwise execute on the runner (R8, same rule as the client installer workflows). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(release): pass the tag ref via env in Determine-release-tag (R8) The one step this PR's hardening missed: it still did REF="${{ github.ref_name }}", interpolating an attacker-controllable tag name straight into the shell, so a crafted v* tag with backticks or $() would execute on the publish runner before the release is created. Now passed as env REF_NAME and read as $REF_NAME, matching the guard and version steps. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

saadqbaland others added 5 commits July 27, 2026 17:07

chore: back-merge main into develop after v0.10.0 promote (#416)
cc71537
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Merge pull request#419from tracebloc/release-train/to-staging
c8d142d
release-train: develop -> staging

cursorBot reviewed Jul 29, 2026
View reviewed changes

Comment threadscripts/install.sh

cursorBot reviewed Jul 29, 2026
View reviewed changes

Comment threadscripts/install.sh

LukasWodka mentioned this pull request Jul 29, 2026
fix(release): rebuilds must run at the tag ref — keyless identity integrity #429
Merged

tracebloc-release-trainBot merged commit 40a04a0 into mainJul 29, 2026
38 checks passed

tracebloc-release-trainBot deleted the release-train/to-main branch July 29, 2026 14:48

cursorBot reviewed Jul 29, 2026
View reviewed changes

tracebloc-release-trainBot restored the release-train/to-main branch July 29, 2026 15:36

LukasWodka mentioned this pull request Aug 24, 2026
fix(release): retry the cosign call, bounded and transient-only (backend#2379) #563
Merged

Navigation Menu

Uh oh!

release-train: staging -> main - #428

release-train: staging -> main#428
tracebloc-release-train[bot] merged 5 commits into
mainfrom
release-train/to-main

LukasWodka commented Jul 29, 2026•
edited by cursor Bot
Loading

Uh oh!

LukasWodka commented Jul 29, 2026

Uh oh!

LukasWodka commented Jul 29, 2026

Uh oh!

LukasWodka commented Jul 29, 2026

Uh oh!

Uh oh!

Uh oh!

LukasWodka commented Jul 29, 2026

Uh oh!

Uh oh!

cursorBot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

LukasWodka commented Jul 29, 2026• edited by cursor BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LukasWodka commented Jul 29, 2026

Uh oh!

LukasWodka commented Jul 29, 2026

Uh oh!

LukasWodka commented Jul 29, 2026

Uh oh!

Uh oh!

Uh oh!

LukasWodka commented Jul 29, 2026

Uh oh!

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

LukasWodka commented Jul 29, 2026•
edited by cursor Bot
Loading