chore(release): v0.6.2 #99

Merged

alex merged 1 commit from release-prep/rolling into main

2026-06-26 11:53:59 +02:00

forgejo-actions commented

2026-06-26 11:47:20 +02:00

Fixed

v0.6.2 substrate sweep — bundles defensive guards + UX clarity + research-observation banking. Closes #56, #54, #47.

scripts/manifest-check.sh: new step 5 validates the v0.4.0+ release-state manifest (.release-toolkit-manifest.json) against actual git history (closes #56). Four sub-checks: (5a) last_released_sha exists in repo; (5b) last_released_sha is an ancestor of HEAD; (5c) last_released_tag points at the recorded SHA; (5d) last_released_version + last_released_tag are consistent under the configured tag_format. Catches the silent-desync class at PR-CI time, before release-decide's walk window can fire incorrectly on a phantom base. 8 new bats tests covering pass + four FAIL paths + malformed-JSON + absent-manifest skip + a Surveyor-2c1e cosmetic fix (5c no longer emits a misleading 'matches' OK line when 5a already failed with empty last_released_sha).

scripts/draft-release.sh: normalizes hard-wrapped CHANGELOG paragraphs before posting the release body (closes #54). Forgejo's release-body renderer treats single newlines as hard breaks, so source paragraphs hard-wrapped at ~70 chars showed as fragmented breaks in the release page (recurring operator footgun across v0.3.3 / v0.3.4 cuts). Joins single newlines within a paragraph into spaces; preserves blank-line separators, fenced code blocks (including internal blank lines), markdown headings / list items / blockquotes / tables / hrs verbatim. Only fires on the CHANGELOG-section fallback path; sidecar (#77 (B1)) already normalizes via fragment summaries. 3 new bats tests covering wrapped-paragraph-joined + fenced-code-with-internal-blank-line + sidecar-bypass.

.forgejo/workflows/_release.yml: manifest PR title reframed chore(manifest): post-cut bookkeeping for ${CUT_TAG} (was chore(manifest): update for ${CUT_TAG}). Per Herald narrative-eye recommendation (cross-chamber dispatch 2026-06-26): "post-cut" leads as the lifecycle-phase signal, "bookkeeping" names the NATURE (administrative record-keeping, not a release to act on like the rolling PR). Distinct enough from chore(release): vX.Y.Z at a one-second glance. Closes the operator-UX clarity gap observed post-v0.6.1 cut.

AGENTS.md §8 gains Axis C — trusted-proxy at the report layer (closes #47 as documented limitation). Two empirical instances: #47 (workflow_runs API reports success without job execution) + #29 (install-deps no-op on pre-baked runner images). Disposition: no proactive code-level workaround; toolkit doesn't currently consume workflow_runs for verification. If future code does, apply the discipline — read the log + verify the artifact, don't trust the run-status. Same shape as Axis A's external-system-claim discipline — pay attention to which LAYER your verification lives at.

Closes #56 + #54 + #47.

v0.6.2 substrate sweep (closes #56 + #54 + #47)

### Fixed **v0.6.2 substrate sweep** — bundles defensive guards + UX clarity + research-observation banking. Closes [#56](https://git.frankenbit.de/frankenbit/release-toolkit/issues/56), [#54](https://git.frankenbit.de/frankenbit/release-toolkit/issues/54), [#47](https://git.frankenbit.de/frankenbit/release-toolkit/issues/47). **`scripts/manifest-check.sh`**: new step 5 validates the v0.4.0+ release-state manifest (`.release-toolkit-manifest.json`) against actual git history (closes [#56](https://git.frankenbit.de/frankenbit/release-toolkit/issues/56)). Four sub-checks: (5a) `last_released_sha` exists in repo; (5b) `last_released_sha` is an ancestor of HEAD; (5c) `last_released_tag` points at the recorded SHA; (5d) `last_released_version` + `last_released_tag` are consistent under the configured `tag_format`. Catches the silent-desync class at PR-CI time, before release-decide's walk window can fire incorrectly on a phantom base. 8 new bats tests covering pass + four FAIL paths + malformed-JSON + absent-manifest skip + a Surveyor-2c1e cosmetic fix (5c no longer emits a misleading 'matches' OK line when 5a already failed with empty `last_released_sha`). **`scripts/draft-release.sh`**: normalizes hard-wrapped CHANGELOG paragraphs before posting the release body (closes [#54](https://git.frankenbit.de/frankenbit/release-toolkit/issues/54)). Forgejo's release-body renderer treats single newlines as hard breaks, so source paragraphs hard-wrapped at ~70 chars showed as fragmented breaks in the release page (recurring operator footgun across v0.3.3 / v0.3.4 cuts). Joins single newlines within a paragraph into spaces; preserves blank-line separators, fenced code blocks (including internal blank lines), markdown headings / list items / blockquotes / tables / hrs verbatim. Only fires on the CHANGELOG-section fallback path; sidecar (#77 (B1)) already normalizes via fragment summaries. 3 new bats tests covering wrapped-paragraph-joined + fenced-code-with-internal-blank-line + sidecar-bypass. **`.forgejo/workflows/_release.yml`**: manifest PR title reframed `chore(manifest): post-cut bookkeeping for ${CUT_TAG}` (was `chore(manifest): update for ${CUT_TAG}`). Per Herald narrative-eye recommendation (cross-chamber dispatch 2026-06-26): "post-cut" leads as the lifecycle-phase signal, "bookkeeping" names the NATURE (administrative record-keeping, not a release to act on like the rolling PR). Distinct enough from `chore(release): vX.Y.Z` at a one-second glance. Closes the operator-UX clarity gap observed post-v0.6.1 cut. **`AGENTS.md`** §8 gains Axis C — trusted-proxy at the report layer (closes [#47](https://git.frankenbit.de/frankenbit/release-toolkit/issues/47) as documented limitation). Two empirical instances: #47 (`workflow_runs` API reports success without job execution) + #29 (install-deps no-op on pre-baked runner images). Disposition: no proactive code-level workaround; toolkit doesn't currently consume `workflow_runs` for verification. If future code does, apply the discipline — read the log + verify the artifact, don't trust the run-status. Same shape as Axis A's external-system-claim discipline — pay attention to which LAYER your verification lives at. Closes [#56](https://git.frankenbit.de/frankenbit/release-toolkit/issues/56) + [#54](https://git.frankenbit.de/frankenbit/release-toolkit/issues/54) + [#47](https://git.frankenbit.de/frankenbit/release-toolkit/issues/47). - v0.6.2 substrate sweep (closes #56 + #54 + #47)