Simplify changed-component releases

.github/workflows/check-gate-ci.yml

@@ -75,9 +75,7 @@ jobs:
               - 'Makefile'
               - '.github/workflows/generated-code-ci.yml'
             release_tooling:
-              - 'release/compatibility/**'
               - 'script/release/**'
-              - '.github/workflows/compatibility-manifest.yml'
               - '.github/workflows/release-changed-components.yml'
               - '.github/workflows/release-tooling-ci.yml'
               - 'CONTRIBUTING.md'

.github/workflows/release-changed-components.yml

@@ -220,33 +220,6 @@ jobs:
       publish: true
     secrets: inherit
 
-  publish-compatibility:
-    name: Publish compatibility manifest
-    needs:
-      - plan
-      - create-releases
-      - publish-java
-      - publish-python
-      - publish-rust
-      - publish-typescript
-      - publish-server
-      - publish-cli
-    if: >
-      always() &&
-      needs.plan.result == 'success' &&
-      needs.create-releases.result == 'success' &&
-      needs.plan.outputs.server == 'true' &&
-      (needs.plan.outputs.java != 'true' || needs.publish-java.result == 'success') &&
-      (needs.plan.outputs.python != 'true' || needs.publish-python.result == 'success') &&
-      (needs.plan.outputs.rust != 'true' || needs.publish-rust.result == 'success') &&
-      (needs.plan.outputs.typescript != 'true' || needs.publish-typescript.result == 'success') &&
-      needs.publish-server.result == 'success' &&
-      (needs.plan.outputs.cli != 'true' || needs.publish-cli.result == 'success')
-    uses: ./.github/workflows/compatibility-manifest.yml
-    with:
-      version: ${{ needs.plan.outputs.version }}
-    secrets: inherit
-
   complete:
     name: Verify publications
     if: always() && needs.plan.result != 'skipped'
@@ -259,7 +232,6 @@ jobs:
       - publish-typescript
       - publish-server
       - publish-cli
-      - publish-compatibility
     runs-on: ubuntu-latest
     steps:
       - name: Report results
@@ -280,7 +252,6 @@ jobs:
           SERVER_RESULT: ${{ needs.publish-server.result }}
           CLI_SELECTED: ${{ needs.plan.outputs.cli }}
           CLI_RESULT: ${{ needs.publish-cli.result }}
-          COMPATIBILITY_RESULT: ${{ needs.publish-compatibility.result }}
         run: |
           {
             echo "### Publication results"
@@ -302,7 +273,6 @@ jobs:
               [[ "${selected}" == "true" ]] || outcome="skipped"
               echo "| ${name} | ${outcome} |"
             done
-            echo "| Compatibility manifest | ${COMPATIBILITY_RESULT} |"
           } >> "${GITHUB_STEP_SUMMARY}"
 
           if [[ "${PLAN_RESULT}" != "success" || "${RELEASE_RESULT}" != "success" ]]; then
@@ -319,6 +289,3 @@ jobs:
               exit 1
             fi
           done
-          if [[ "${SERVER_SELECTED}" == "true" && "${COMPATIBILITY_RESULT}" != "success" ]]; then
-            exit 1
-          fi

.github/workflows/release-tooling-ci.yml

@@ -4,17 +4,13 @@ on:
   push:
     branches: [main]
     paths:
-      - "release/compatibility/**"
       - "script/release/**"
-      - ".github/workflows/compatibility-manifest.yml"
       - ".github/workflows/release-changed-components.yml"
       - ".github/workflows/release-tooling-ci.yml"
       - "CONTRIBUTING.md"
   pull_request:
     paths:
-      - "release/compatibility/**"
       - "script/release/**"
-      - ".github/workflows/compatibility-manifest.yml"
       - ".github/workflows/release-changed-components.yml"
       - ".github/workflows/release-tooling-ci.yml"
       - "CONTRIBUTING.md"

CONTRIBUTING.md

@@ -166,29 +166,12 @@ Each component has its own version and tag prefix. Create a GitHub Release for t
 
 For coordinated releases, run **Release changed components** from the **main** branch and enter one semantic version. The workflow applies that version to every selected component. It compares each component with its own latest reachable release tag, uses that tag as the start of the component's generated release notes, preflights every selected target tag, creates the GitHub Releases, and directly invokes each publisher. The run succeeds only after every selected registry, Docker, CLI asset, and Homebrew publication succeeds. Go SDK publication is complete when its module tag and GitHub Release exist.
 
-Every coordinated release that selects Server also publishes a compatibility
-manifest. Add `release/compatibility/<version>.json` before dispatching the
-release. The declaration records the reviewed protocol intervals, open-Flow
-compatibility, persistence compatibility, and rollout order. Release tooling
-verifies those intervals against each component's tagged source, reads the published CLI checksums and
-Server image digest, and uploads
-`dex-compatibility-v<version>.json` to the Server GitHub Release.
-
-For a partial release, include `componentVersions` with all seven component keys:
-`server`, `cli`, `sdkGo`, `sdkJava`, `sdkPython`, `sdkRust`, and `sdkTypeScript`.
-Changed components use the requested version; unchanged components retain their
-published versions. The planner checks this declaration before creating tags.
-The manifest's `sourceCommit` identifies Server; each component's tag identifies
-its own source. Every declared client protocol must overlap the Server interval.
-Omitting `componentVersions` declares that every component uses the release version.
-An SDK-only or CLI-only release does not rewrite an existing Server manifest.
-
-Use **Publish compatibility manifest** to backfill or reverify an already
-published Server release, including a partial release. The workflow adds the asset
-when absent and requires byte-identical contents when it already exists;
-it never recreates component tags or republishes packages. Downstream systems
-must verify the downloaded manifest digest before changing a Server or SDK
-version.
+Coordinated releases do not create a cross-component compatibility manifest.
+Each selected component publishes its native immutable artifacts. CLI publishes
+`checksums.txt`, Server publishes its versioned image, and SDK registries retain
+their normal package checksums. Applications update explicit component versions
+in ordinary pull requests and use compilation and integration tests as the
+compatibility gate.
 
 Components without relevant changes are skipped. A run with no relevant changes succeeds without creating tags. Documentation and workflow changes alone do not select a product release. A missing component baseline is treated as its first release.
 

Makefile

@@ -10,7 +10,7 @@ GENERATED_CODE_PATHS := \
 
 .PHONY: help ci-runner-check copyright copyright-check generated-code generated-code-check githooks docs-prose-check docs-prose-fix release-tooling-test
 
-release-tooling-test: ## Verify component selection and immutable release manifests
+release-tooling-test: ## Verify changed-component selection and release preflight
 	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s script/release -p '*_test.py'
 
 help: ## Show targets

script/release/changed_components.py

@@ -16,9 +16,6 @@
 from dataclasses import dataclass
 from pathlib import Path
 
-from compatibility_manifest import ManifestError, component_versions, load_declaration
-
-
 VERSION_PATTERN = re.compile(
     r"^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)"
     r"(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?$"
@@ -179,20 +176,6 @@ def write_outputs(output_path: Path, version: str) -> int:
             print(f"- {collision}", file=sys.stderr)
         return 1
 
-    if any(component.key == "server" and selected for component, _, selected, _ in selections):
-        try:
-            declaration = load_declaration(Path("release/compatibility") / f"{version}.json", version)
-            versions = component_versions(declaration)
-            names = {"go": "sdkGo", "rust": "sdkRust", "java": "sdkJava", "python": "sdkPython", "typescript": "sdkTypeScript"}
-            for component, baseline, selected, target in selections:
-                key = names.get(component.key, component.key)
-                declared_tag = f"{component.tag_prefix}{versions[key]}"
-                if declared_tag != (target if selected else baseline):
-                    raise ManifestError(f"declared {key} release does not match the release plan")
-        except ManifestError as error:
-            print(f"Compatibility preflight failed: {error}", file=sys.stderr)
-            return 1
-
     output_path.write_text("\n".join(output_lines) + "\n", encoding="utf-8")
     return 0