-
v0.47.0
StableSome checks failedchangelog-body-check / changelog body Cold-Read linter (pull_request) Successful in 6schangelog-body-check / check (pull_request) Successful in 0scheck-self-bootstrap / check (pull_request) Has been skippedfragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4sfragment-check / changelog fragment-kind (pull_request) Successful in 6sfragment-check / check (pull_request) Successful in 0sgo-ci / lint + build + test (pull_request) Successful in 26smanifest-check / manifest-vs-tag consistency (pull_request) Successful in 7smanifest-check / check (pull_request) Successful in 0sregister-check / register-drift check (pull_request) Successful in 7sregister-check / check (pull_request) Successful in 0stests / workflow-schema (pull_request) Successful in 3stests / bats (pull_request) Successful in 8stests / shellcheck (pull_request) Successful in 2scheck-self-bootstrap / check (push) Successful in 5sgo-ci / lint + build + test (push) Successful in 25srelease / decide + act (push) Successful in 10srelease / release (push) Successful in 0stests / workflow-schema (push) Successful in 3stests / bats (push) Successful in 8stests / shellcheck (push) Successful in 2sgoreleaser / build + publish rt asset (push) Successful in 1m24sgoreleaser / publish the rt image + bake its digest (push) Failing after 20sgoreleaser / adopters can pull the published image (push) Has been skippedgoreleaser / adopters can fetch the published asset (push) Has been skippedreleased this
2026-08-26 13:55:04 +02:00 | 647 commits to main since this releaseAdded
None.
Changed
-
contract source-of-record split: byte-authority and provenance are now separate fields, and both are checkable (#849)
The single field carried two different claims, so a naive check reddened on six correct sites.
Source of recordnow lists only paths that must resolve today.Ported fromlists historical paths, checked for having ever existed.scripts/contract-paths-check.shgrades both halves and classifies globs rather than resolving them.
Fixed
-
cut-cancellation recovery docs: recovery (A) now covers manifest-create, non-atomicity, and the published-release case (#660)
docs/integration.md § Cut-cancellation recovery (#417)no longer says "edit" the manifest for adopters who never had one — it gives the full create-from-scratch JSON. The three (A) steps are now named as non-atomic, since a bare tag push can silently clear the bootstrap population's orphan check unfinished. (B) is flagged as actively wrong once a release is already published, per the live 2026-08-25 incident (#884). -
dry-run preview docs: fix the fidelity-guarantee direction and two stale claims (#662)
The asymmetry #662 quoted —
rt decidereportingmode=cutfor a run that would resolvemode=updatelive — was already closed at the code level by #689. The doc now says so plainly:--dry-runis a computational no-op forrt decide. Also retires the staleFORGEJO_API_DRY_RUNenv-var reference and names a live gap:rt release's idempotency pre-check is faked under--dry-run, always previewing a create. -
changelog: suppress duplicate commit bullets covered by body-referenced fragments (#672)
Multi-commit changes can keep the richer fragment entry without widening the add-only fragment walk that protects against silent omission.
-
release: disclose whether post-cut manifest bookkeeping creates or updates (#679)
The typed post-cut boundary now preserves the observable create/update branch evidence from the release workflow.
-
prep:
rt prep --dry-runno longer writes your checkout. It runs against a scratch copy and prints the diff it would produce, so a failed run leaves nothing behind for the retry's clean-tree gate to refuse.post_bump_hooksrun in the scratch copy; anything they touch outside their working directory is still not contained (#708) -
decide: a cut-safeguard that declines no longer resolves to
mode=noopwhen the fall-through finds nothing release-relevant. That path droppedsafeguard_fail,safeguard_versionandprep_shaand exited 0, so a decline read exactly like "nothing to release". It now emitsmode=blockedwithreason=safeguard_decline, which the workflow already fails on. A could-not-grade stays distinguishable from a refusal (#711) -
operations: document drain-before-review order for rolling release PRs (#770)
Land other work before reviewing the rolling PR, then merge it before another main landing can rebuild its content and invalidate the approval. This is a regeneration rule, not an outdated-branch rule.
-
manifest: a draft cut no longer records a completed release. Schema 2 adds
last_released_published, so a cut that leaves the release unpublished says so.manifest-checknow reports the absent tag as an unfinished cut, not a desync. Schema 1 is still read, and migrates only when a record needs the new field (#805) -
849: fragment density, and scrub a register over-match in the arms
-
ci: keep the blocked arm FLAT so its bats guard reads what it means to
Removed
None.
Deprecated
None.
Upgrade
None.
Internal
-
test guards: make pending-cut branch extraction safe for nested shell cases (#889)
The workflow contract is unchanged; the structural guard now proves both a nested-case success path and a missing-refusal inverse fails closed.
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-