• v0.47.0 239b5063c9

    v0.47.0
    Some checks failed
    changelog-body-check / changelog body Cold-Read linter (pull_request) Successful in 6s
    changelog-body-check / check (pull_request) Successful in 0s
    check-self-bootstrap / check (pull_request) Has been skipped
    fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
    fragment-check / changelog fragment-kind (pull_request) Successful in 6s
    fragment-check / check (pull_request) Successful in 0s
    go-ci / lint + build + test (pull_request) Successful in 26s
    manifest-check / manifest-vs-tag consistency (pull_request) Successful in 7s
    manifest-check / check (pull_request) Successful in 0s
    register-check / register-drift check (pull_request) Successful in 7s
    register-check / check (pull_request) Successful in 0s
    tests / workflow-schema (pull_request) Successful in 3s
    tests / bats (pull_request) Successful in 8s
    tests / shellcheck (pull_request) Successful in 2s
    check-self-bootstrap / check (push) Successful in 5s
    go-ci / lint + build + test (push) Successful in 25s
    release / decide + act (push) Successful in 10s
    release / release (push) Successful in 0s
    tests / workflow-schema (push) Successful in 3s
    tests / bats (push) Successful in 8s
    tests / shellcheck (push) Successful in 2s
    goreleaser / build + publish rt asset (push) Successful in 1m24s
    goreleaser / publish the rt image + bake its digest (push) Failing after 20s
    goreleaser / adopters can pull the published image (push) Has been skipped
    goreleaser / adopters can fetch the published asset (push) Has been skipped
    Stable

    release-bot released this 2026-08-26 13:55:04 +02:00 | 647 commits to main since this release

    Added

    None.

    Changed

    • contract source-of-record split: byte-authority and provenance are now separate fields, and both are checkable (#849)

      The single field carried two different claims, so a naive check reddened on six correct sites. Source of record now lists only paths that must resolve today. Ported from lists historical paths, checked for having ever existed. scripts/contract-paths-check.sh grades both halves and classifies globs rather than resolving them.

    Fixed

    • cut-cancellation recovery docs: recovery (A) now covers manifest-create, non-atomicity, and the published-release case (#660)

      docs/integration.md § Cut-cancellation recovery (#417) no longer says "edit" the manifest for adopters who never had one — it gives the full create-from-scratch JSON. The three (A) steps are now named as non-atomic, since a bare tag push can silently clear the bootstrap population's orphan check unfinished. (B) is flagged as actively wrong once a release is already published, per the live 2026-08-25 incident (#884).

    • dry-run preview docs: fix the fidelity-guarantee direction and two stale claims (#662)

      The asymmetry #662 quoted — rt decide reporting mode=cut for a run that would resolve mode=update live — was already closed at the code level by #689. The doc now says so plainly: --dry-run is a computational no-op for rt decide. Also retires the stale FORGEJO_API_DRY_RUN env-var reference and names a live gap: rt release's idempotency pre-check is faked under --dry-run, always previewing a create.

    • changelog: suppress duplicate commit bullets covered by body-referenced fragments (#672)

      Multi-commit changes can keep the richer fragment entry without widening the add-only fragment walk that protects against silent omission.

    • release: disclose whether post-cut manifest bookkeeping creates or updates (#679)

      The typed post-cut boundary now preserves the observable create/update branch evidence from the release workflow.

    • prep: rt prep --dry-run no longer writes your checkout. It runs against a scratch copy and prints the diff it would produce, so a failed run leaves nothing behind for the retry's clean-tree gate to refuse. post_bump_hooks run in the scratch copy; anything they touch outside their working directory is still not contained (#708)

    • decide: a cut-safeguard that declines no longer resolves to mode=noop when the fall-through finds nothing release-relevant. That path dropped safeguard_fail, safeguard_version and prep_sha and exited 0, so a decline read exactly like "nothing to release". It now emits mode=blocked with reason=safeguard_decline, which the workflow already fails on. A could-not-grade stays distinguishable from a refusal (#711)

    • operations: document drain-before-review order for rolling release PRs (#770)

      Land other work before reviewing the rolling PR, then merge it before another main landing can rebuild its content and invalidate the approval. This is a regeneration rule, not an outdated-branch rule.

    • manifest: a draft cut no longer records a completed release. Schema 2 adds last_released_published, so a cut that leaves the release unpublished says so. manifest-check now reports the absent tag as an unfinished cut, not a desync. Schema 1 is still read, and migrates only when a record needs the new field (#805)

    • 849: fragment density, and scrub a register over-match in the arms

    • ci: keep the blocked arm FLAT so its bats guard reads what it means to

    Removed

    None.

    Deprecated

    None.

    Upgrade

    None.

    Internal

    • test guards: make pending-cut branch extraction safe for nested shell cases (#889)

      The workflow contract is unchanged; the structural guard now proves both a nested-case success path and a missing-refusal inverse fails closed.

    Downloads