Skip to content

release: publish v2.0.6 from hardened main #96

Closed
Closed
release: publish v2.0.6 from hardened main#96
Labels
area:releaseRelease process, versioning, or changelog work.priority:highNeeds prompt attention.type:maintenanceNon-feature maintenance, cleanup, or org work.

Description

@ss-o
ss-o
opened on Aug 27, 2026

Context

The immutable v2.0.1 release does not include the re-applied process-substitution fix from #89.

The approved v2.0.2 attempt created an annotated tag at 39b02adf471d1f40df0b985565dc16b97add1127, but run #33060334762 failed before validation because the validation job invoked Zsh without provisioning it. No v2.0.2 GitHub release or assets were created.

PR #103 repaired that job and was squash-merged at 63fe2e6f2d0a649af5f2a7e9abccf67e2a80336d. The approved v2.0.3 attempt passed boundary validation plus both platform build, test, package, and artifact stages. Run #33061392339 then failed because the Create Release job independently invoked the Zsh validator without provisioning Zsh. No v2.0.3 GitHub release or assets were created.

PR #104 completed validator provisioning and fully qualified every remote ref. It was squash-merged at ea511d977800e3916776ad43d055afd4dcca734f, with every PR and merged-main check green.

The approved v2.0.4 attempt in run #33063650842 passed boundary validation, both exact-tag platform suites, packaging, artifact upload, and checksum preparation. It created private draft release 377741043 with all seven assets, then failed because GET /releases/tags/v2.0.4 is a published-release endpoint and returned 404 for the draft. The ERR cleanup repeated the same lookup and could not recover the draft ID.

Under explicit maintainer authority, draft 377741043 was revalidated and deleted. The v2.0.4 tag remains unchanged, and both unexpired Actions artifact bundles remain available as evidence.

PR #105 added exact authenticated draft resolution, required one tag-and-target match, and bound validation, publication, and guarded cleanup to the numeric release ID. It was squash-merged at 8b480c547146470bc664f8c31b602304d0cee966, with every PR and merged-main check green.

The approved v2.0.5 attempt in run #33068418528 passed boundary validation, both exact-tag platform suites, packaging, artifact upload, and checksum preparation. It created a private draft, then the immediate authenticated release-list query found zero exact matches. The Create Release job stopped, and the ERR cleanup left no release or draft object. The v2.0.5 annotated tag remains unchanged at tag object 75549a1e8bc31e4f44bbe45d85b47870f3428b6d, peeled commit 8b480c547146470bc664f8c31b602304d0cee966.

The evidence supports a post-create release-list visibility race: the immediate query observed zero exact matches, while the later cleanup path left no draft. A reviewed repair must use bounded exact polling without weakening tag-and-target binding or cardinality.

PR #106 added bounded exact polling with delayed-visibility regression coverage and was squash-merged at af6fc1d8219f9f3d8c6b9c60330de69342ee2054, with every pull-request and merged-main check green.

Under fresh maintainer approval, annotated tag v2.0.6 was created at that exact commit and published successfully by run #33071565632.

Parent governance issue: #70.

Blockers

  • Resolve the open filesystem CodeQL alerts.
  • Enforce the full exact-tag release suite and harden release-ref validation.
  • Reconcile licensing and include notices in every package.
  • Provision Zsh and fully qualified refs for every release validator invocation.
  • Capture exactly one matching draft ID through the authenticated release-list endpoint, use that ID for validation and cleanup, and add regression coverage for the failure path.
  • Resolve private v2.0.4 draft 377741043 under explicit destructive-action authority after preserving its evidence.
  • Tolerate bounded post-create release-list visibility while preserving exact tag-and-target cardinality and guarded numeric-ID cleanup, with delayed-visibility regression coverage.

Required release content

  • Process-substitution/non-regular-source fix from fix: skip ZWC compilation for non-regular sources #89.
  • Restored root README and licensing material.
  • Filesystem-security remediation.
  • Hardened release workflow and package validation.
  • Verified checksums and immutable GitHub release assets.
  • Draft-aware publication and cleanup with exact release-ID binding.
  • Bounded exact draft discovery for post-create list visibility.

Acceptance criteria

  • The existing v2.0.2, v2.0.3, v2.0.4, and v2.0.5 tags remain unchanged.
  • No failed tag has a published GitHub release.
  • The orphaned v2.0.4 private draft was deleted only with explicit maintainer authorization.
  • An annotated v2.0.6 tag is created only from reviewed, green main after every blocker is closed.
  • The exact tag commit passes the full functional suite on all release platforms.
  • Published assets include required notices and verified checksums.
  • The published Linux artifact passes the process-substitution regression without stderr.
  • Release state and evidence are recorded here before closure.

Do not retry, move, or delete v2.0.2, v2.0.3, v2.0.4, or v2.0.5. Do not dispatch another release workflow or create v2.0.6 without explicit maintainer approval for the corresponding action.

Activity

  1. ss-o
    added
    area:releaseRelease process, versioning, or changelog work.
    priority:highNeeds prompt attention.
    status:blockedCannot proceed until an external dependency or decision changes.
    type:maintenanceNon-feature maintenance, cleanup, or org work.
    on Aug 27, 2026
  2. ss-o
    added a parent issue on Aug 27, 2026
  3. github-project-automation
    added this to Z-shell Deliveryon Aug 27, 2026
  4. github-project-automation
    moved this to Triage in Z-shell Deliveryon Aug 27, 2026
  5. ss-o
    moved this from Triage to Blocked in Z-shell Deliveryon Aug 27, 2026
  6. ss-o
    marked this as blocked by 3 issues on Aug 27, 2026
  7. ss-o
    removed
    status:blockedCannot proceed until an external dependency or decision changes.
    on Aug 27, 2026
  8. ss-o
    moved this from Blocked to Todo in Z-shell Deliveryon Aug 27, 2026

  9. ss-o commented on Aug 27, 2026

    @ss-o
    ss-o
    on Aug 27, 2026
    MemberAuthor

    The three release blockers are complete:

    All three implementation PRs completed their required CI, documentation, and CodeQL checks successfully. The blocker checklist is now current, status:blocked has been removed, and the Project item is ready for Todo.

    This triage update does not authorize creating v2.0.2, dispatching the release workflow, publishing assets, or otherwise starting the release. Those actions still require separate explicit approval at release time.

  10. ss-o
    moved this from Todo to In Progress in Z-shell Deliveryon Aug 27, 2026

  11. 21 remaining items

  12. ss-o
    changed the title [-]release: publish v2.0.4 from hardened main[/-] [+]release: publish v2.0.5 from hardened main[/+] on Aug 27, 2026
  13. ss-o
    moved this from In Progress to Blocked in Z-shell Deliveryon Aug 27, 2026

  14. ss-o commented on Aug 27, 2026

    @ss-o
    ss-o
    on Aug 27, 2026
    MemberAuthor

    Agent handoff

    Status: Blocked
    Repository: z-shell/zpmod
    Branch/PR: No branch or pull request exists yet for the draft-ID repair
    Tracker/Issue: #96 in Z-Shell Delivery

    Current state

    • v2.0.4 run #33063650842 passed boundary validation, both exact-tag platform suites, packaging, artifact upload, and checksum preparation.
    • The Create Release step created private draft 377741043 and uploaded seven assets, then failed while querying the published-release-by-tag endpoint for a draft ID.
    • The ERR cleanup repeated that published-only lookup and left the private draft intact.
    • Annotated tag v2.0.4 remains exact and unchanged at tag object e35c79b9dfc9a5d8e387865178555b4fb3e4f303, peeled commit ea511d977800e3916776ad43d055afd4dcca734f.
    • No retry was made. The next publication target is v2.0.5.

    Verification

    • Release run jobs: Validate release boundary, Build (linux), and Build (macos) passed; Create Release failed.
    • Failed log: gh: Not Found (HTTP 404) immediately after draft creation returned its untagged URL.
    • Authenticated release-list API: exactly one v2.0.4 draft, ID 377741043, expected target commit, seven uploaded assets, published_at: null.
    • Remote tag inspection: v2.0.4 tag object and peeled commit match the values above.

    Blockers

    • The workflow uses GET /releases/tags/{tag} to identify a draft, but GitHub documents that endpoint as returning a published release. Authenticated List releases includes drafts.
    • Draft deletion is destructive and requires explicit authorization for exact draft ID 377741043.
    • A reviewed repair and fresh release approval are required before v2.0.5.

    Next steps

    1. Obtain explicit authority to delete only private draft 377741043, after revalidating its draft state, tag, target commit, and asset count.
    2. Branch from current main and add a failing regression for draft lookup and failure cleanup.
    3. Query the authenticated release list, require exactly one draft matching the expected tag and target commit, and bind validation, publication, and cleanup to its numeric ID.
    4. Run focused policy tests, syntax checks, Actionlint, and all 52 CTests; open and merge a linked pull request only if every PR and merged-main check is green.
    5. Obtain fresh authorization for one annotated v2.0.5 tag and one release dispatch. Stop without retry on any changed fingerprint or failure.
  15. ss-o
    removed
    status:blockedCannot proceed until an external dependency or decision changes.
    on Aug 27, 2026
  16. ss-o
    moved this from Blocked to In Progress in Z-shell Deliveryon Aug 27, 2026

  17. ss-o commented on Aug 27, 2026

    @ss-o
    ss-o
    on Aug 27, 2026
    MemberAuthor

    PR #105 is squash-merged and the draft-ID blocker is resolved.

    Issue #96 is ready at the release approval gate. Creating the annotated v2.0.5 tag and dispatching the release workflow remain separately authorization-gated; neither action was taken in this phase.

  18. ss-o
    changed the title [-]release: publish v2.0.5 from hardened main[/-] [+]release: publish v2.0.6 from hardened main[/+] on Aug 27, 2026
  19. ss-o
    added
    status:blockedCannot proceed until an external dependency or decision changes.
    on Aug 27, 2026

  20. ss-o commented on Aug 27, 2026

    @ss-o
    ss-o
    on Aug 27, 2026
    MemberAuthor

    Release attempt v2.0.5 stopped without retry.

    • Run: https://github.com/z-shell/zpmod/actions/runs/33068418528
    • Annotated tag object: 75549a1e8bc31e4f44bbe45d85b47870f3428b6d
    • Peeled commit: 8b480c547146470bc664f8c31b602304d0cee966
    • Boundary validation: passed
    • Linux exact-tag suite, packaging, and artifact upload: passed
    • macOS exact-tag suite, packaging, and artifact upload: passed
    • Release asset preparation and checksum verification: passed
    • Create Release: created a private draft, then failed when the immediate authenticated release-list query found zero exact matches for the tag and target commit
    • Exact failure: expected exactly one draft for v2.0.5 at 8b480c547146470bc664f8c31b602304d0cee966; found 0
    • Current authenticated release list: no v2.0.5 release and no drafts
    • Preserved artifacts through 2026-09-26: packages-macos artifact 9644762177 (52,467 bytes) and packages-linux artifact 9644756156 (138,844 bytes)
    • Preserved state: v2.0.2, v2.0.3, v2.0.4, and v2.0.5 tags remain unchanged; no failed tag has a published release

    The evidence supports, but does not conclusively prove, a post-create list-visibility race. The immediate resolver saw zero matches, while the later ERR cleanup left no draft, which suggests the transient draft became visible in time for guarded cleanup.

    The next safe recovery is a reviewed repair that adds bounded polling for only the post-create list-visibility window while preserving exact tag-and-target matching, cardinality, numeric-ID binding, and guarded cleanup. It must include delayed-visibility regression coverage. The next immutable release target is v2.0.6, after the repair and fresh maintainer approval. No retry was made.

  21. ss-o
    moved this from In Progress to Blocked in Z-shell Deliveryon Aug 27, 2026

  22. ss-o commented on Aug 27, 2026

    @ss-o
    ss-o
    on Aug 27, 2026
    MemberAuthor

    Release hardening candidate: #106

    The PR makes draft release resolution tolerate delayed GitHub API visibility while preserving exact tag and target matching, numeric release ID validation, and fail-fast behavior for ambiguous or malformed responses.

    Verified locally on commit 84307d7eee0ce1107e4a03fa19ad894fc56f17fd:

    • host Release build and CTest: 53/53 passed
    • Zsh 5.8.1 container: 53/53 passed
    • Zsh 5.9 full-development container: 53/53 passed
    • focused release-resolution and workflow-policy tests passed
    • Actionlint, Zsh syntax, zcompile, diff checks, and commit-scoped Trunk checks passed

    This is a review candidate only. It does not merge, retag or create v2.0.6, dispatch the release workflow, or publish a release.

  23. ss-o
    removed
    status:blockedCannot proceed until an external dependency or decision changes.
    on Aug 27, 2026

  24. ss-o commented on Aug 27, 2026

    @ss-o
    ss-o
    on Aug 27, 2026
    MemberAuthor

    v2.0.6 is published and independently verified.

    • Release: https://github.com/z-shell/zpmod/releases/tag/v2.0.6
    • Release ID: 377803086
    • Workflow run: https://github.com/z-shell/zpmod/actions/runs/33071565632
    • Annotated tag object: 7e4219e8fdda613ea76055da3dbd8e737ed755f3
    • Peeled release commit: af6fc1d8219f9f3d8c6b9c60330de69342ee2054
    • Boundary validation, Linux build, macOS build, and Create Release jobs: successful
    • Published assets: seven, comprising four platform archives, DEB, RPM, and SHA256SUMS
    • Integrity: every local checksum passed and every downloaded file matched its GitHub API SHA-256 digest
    • Licensing: all four archives, the DEB, and the RPM contain the exact required LICENSE, NOTICE, MIT, Zsh license, and copyright payloads
    • Linux regression: the downloaded module passed process_substitution_source.zsh with empty stderr
    • Release state: published, non-draft, non-prerelease, and selected as latest
    • Prior immutable tags v2.0.2 through v2.0.5 remain unchanged, with no failed tag published
    • Dispatch count: one, with no retry

    All blockers and acceptance criteria are resolved. Closing as completed.

  25. ss-o
    closed this as completedon Aug 27, 2026
  26. github-project-automation
    moved this from Blocked to Done in Z-shell Deliveryon Aug 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:releaseRelease process, versioning, or changelog work.priority:highNeeds prompt attention.type:maintenanceNon-feature maintenance, cleanup, or org work.

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions