mirror of
https://github.com/affaan-m/ECC.git
synced 2026-09-03 06:34:16 +08:00
chore(release): prepare signed 2.2.1 patch
This commit is contained in:
haelyra
@@ -6,7 +6,7 @@
|
||||
"plugins": [
|
||||
{
|
||||
"name": "ecc",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"source": {
|
||||
"source": "local",
|
||||
"path": "./"
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
"name": "ecc",
|
||||
"source": "./",
|
||||
"description": "Harness-native ECC operator layer - 68 agents, 286 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"author": {
|
||||
"name": "Affaan Mustafa",
|
||||
"email": "me@affaanmustafa.com"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "ecc",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"description": "Harness-native ECC plugin for engineering teams - 68 agents, 286 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
|
||||
"author": {
|
||||
"name": "Affaan Mustafa",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "ecc",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"description": "Harness-native ECC workflows for Codex: shared skills, production-ready MCP configs, and selective-install-aligned conventions for TDD, security scanning, code review, and autonomous development.",
|
||||
"author": {
|
||||
"name": "Affaan Mustafa",
|
||||
@@ -10,7 +10,16 @@
|
||||
"homepage": "https://ecc.tools",
|
||||
"repository": "https://github.com/affaan-m/ECC",
|
||||
"license": "MIT",
|
||||
"keywords": ["codex", "agents", "skills", "tdd", "code-review", "security", "workflow", "automation"],
|
||||
"keywords": [
|
||||
"codex",
|
||||
"agents",
|
||||
"skills",
|
||||
"tdd",
|
||||
"code-review",
|
||||
"security",
|
||||
"workflow",
|
||||
"automation"
|
||||
],
|
||||
"skills": "./skills/",
|
||||
"mcpServers": "./.mcp.json",
|
||||
"hooks": "./hooks/codex-hooks.json",
|
||||
@@ -20,7 +29,11 @@
|
||||
"longDescription": "ECC is a harness-native operator system for Codex and adjacent agent harnesses. It packages reusable skills, MCP configs, TDD workflows, security scanning, code review, architecture decisions, operator workflows, and release gates in one installable plugin.",
|
||||
"developerName": "Affaan Mustafa",
|
||||
"category": "Coding",
|
||||
"capabilities": ["Interactive", "Read", "Write"],
|
||||
"capabilities": [
|
||||
"Interactive",
|
||||
"Read",
|
||||
"Write"
|
||||
],
|
||||
"websiteURL": "https://ecc.tools",
|
||||
"privacyPolicyURL": "https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement",
|
||||
"termsOfServiceURL": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service",
|
||||
|
||||
4
.opencode/package-lock.json
generated
4
.opencode/package-lock.json
generated
@@ -1,12 +1,12 @@
|
||||
{
|
||||
"name": "ecc-universal",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "ecc-universal",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"license": "MIT",
|
||||
"devDependencies": {
|
||||
"@opencode-ai/plugin": "^1.4.3",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "ecc-universal",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"description": "ECC plugin for OpenCode - agents, commands, hooks, and skills",
|
||||
"main": "dist/index.js",
|
||||
"types": "dist/index.d.ts",
|
||||
|
||||
@@ -537,7 +537,7 @@ export const ECCHooksPlugin: ECCHooksPluginFn = async ({
|
||||
const contextBlock = [
|
||||
"# ECC Context (preserve across compaction)",
|
||||
"",
|
||||
"## Active Plugin: ECC v2.2.0",
|
||||
"## Active Plugin: ECC v2.2.1",
|
||||
"- Hooks: file.edited, tool.execute.before/after, session.created/idle/deleted, shell.env, compacting, permission.ask",
|
||||
"- Tools: run-tests, check-coverage, security-audit, format-code, lint-check, git-summary, changed-files",
|
||||
"- Agents: 13 specialized (planner, architect, tdd-guide, code-reviewer, security-reviewer, build-error-resolver, e2e-runner, refactor-cleaner, doc-updater, go-reviewer, go-build-resolver, database-reviewer, python-reviewer)",
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
This is a **production-ready AI coding plugin** providing 68 specialized agents, 286 skills, 94 commands, and automated hook workflows for software development.
|
||||
|
||||
**Version:** 2.2.0
|
||||
**Version:** 2.2.1
|
||||
|
||||
## Core Principles
|
||||
|
||||
|
||||
@@ -80,7 +80,7 @@
|
||||
|
||||
## 最新动态
|
||||
|
||||
### v2.2.0 — 引导式多 Harness 安装（2026年8月）
|
||||
### v2.2.1 — 引导式多 Harness 安装（2026年8月）
|
||||
|
||||
新增可审查的 Claude Code、Codex 与 Kimi Code 多 Harness 安装流程，并提供同步的 npm 命令入口。
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
spec_version: "0.1.0"
|
||||
name: ecc
|
||||
version: 2.2.0
|
||||
version: 2.2.1
|
||||
description: "Initial gitagent export surface for ECC's shared skill catalog, governance, and identity. Native agents, commands, and hooks remain authoritative in the repository while manifest coverage expands."
|
||||
author: affaan-m
|
||||
license: MIT
|
||||
|
||||
@@ -703,7 +703,7 @@ Suggested payload:
|
||||
"skippedModules": []
|
||||
},
|
||||
"source": {
|
||||
"repoVersion": "2.2.0",
|
||||
"repoVersion": "2.2.1",
|
||||
"repoCommit": "git-sha",
|
||||
"manifestVersion": 1
|
||||
},
|
||||
|
||||
@@ -79,7 +79,7 @@ Este repositório contém apenas o código. Os guias explicam tudo.
|
||||
|
||||
## O Que Há de Novo
|
||||
|
||||
### v2.2.0 — Instalação Guiada para Múltiplos Harnesses (Ago 2026)
|
||||
### v2.2.1 — Instalação Guiada para Múltiplos Harnesses (Ago 2026)
|
||||
|
||||
Adiciona uma instalação revisável para Claude Code, Codex e Kimi Code, com uma entrada de comando npm sincronizada.
|
||||
|
||||
|
||||
115
docs/releases/2.2.1/launch-runbook.md
Normal file
115
docs/releases/2.2.1/launch-runbook.md
Normal file
@@ -0,0 +1,115 @@
|
||||
# ECC 2.2.1 signed patch release runbook
|
||||
|
||||
Only an authorized maintainer may create or push the `v2.2.1` tag, change npm
|
||||
dist-tags, or publish the GitHub Release.
|
||||
|
||||
## Availability model
|
||||
|
||||
The default npm install remains `ecc-universal@2.2.0` until the final promotion
|
||||
step succeeds. The release workflow publishes `2.2.1` under the `staged` tag,
|
||||
reads its registry integrity back, compares those bytes with the exact archive
|
||||
that passed the three-platform lifecycle, and only then moves `latest` to
|
||||
`2.2.1`.
|
||||
|
||||
The native Claude marketplace install remains an independent install path
|
||||
throughout the npm rollout:
|
||||
|
||||
```text
|
||||
/plugin marketplace add https://github.com/affaan-m/ECC
|
||||
/plugin install ecc@ecc
|
||||
```
|
||||
|
||||
Never unpublish `2.2.0` or `2.2.1`. npm dist-tags provide the reversible
|
||||
switch.
|
||||
|
||||
## Historical exception
|
||||
|
||||
`v2.2.0` is already public and must stay immutable, even though
|
||||
`git tag -v v2.2.0` returns `error: no signature found`. ECC-031 closes that
|
||||
provenance gap by shipping a new signed patch release. Do not move, recreate, or
|
||||
reuse `v2.2.0`.
|
||||
|
||||
## Preflight before the tag
|
||||
|
||||
1. The `2.2.1` version-prep PR must be merged.
|
||||
2. CI and CodeQL on the exact merged `main` commit must be green.
|
||||
3. `HEAD`, `origin/main`, and the intended release commit must all match.
|
||||
4. `npm view ecc-universal@2.2.1 version` must return `E404`. Any other
|
||||
registry error blocks the release.
|
||||
5. `npm view ecc-universal dist-tags --json` must still show `latest: 2.2.0`.
|
||||
6. The release operator must have a locally available signing identity before
|
||||
creating the tag.
|
||||
|
||||
## The release switch
|
||||
|
||||
From a clean, current `main` checkout on the exact green prep commit:
|
||||
|
||||
```bash
|
||||
git fetch origin main --tags
|
||||
git switch main
|
||||
git pull --ff-only origin main
|
||||
git status --short
|
||||
git rev-parse HEAD
|
||||
git rev-parse origin/main
|
||||
```
|
||||
|
||||
The commit IDs must match and `git status --short` must print nothing. The
|
||||
authorized maintainer then creates and verifies the signed release tag:
|
||||
|
||||
```bash
|
||||
git tag -s v2.2.1 -m "ECC 2.2.1" HEAD
|
||||
git tag -v v2.2.1
|
||||
git push origin refs/tags/v2.2.1
|
||||
```
|
||||
|
||||
That tag push is the only release switch. The workflow then:
|
||||
|
||||
1. Requires the tag commit to equal `origin/main`.
|
||||
2. Packs and hashes the npm archive once.
|
||||
3. Runs the exact archive on Linux, macOS, and Windows.
|
||||
4. Publishes the archive to the npm `staged` tag with provenance.
|
||||
5. Reads back and verifies registry integrity.
|
||||
6. Atomically promotes the verified version to `latest`.
|
||||
7. Creates the GitHub Release from the reviewed notes.
|
||||
|
||||
## Immediate canary
|
||||
|
||||
After the workflow succeeds:
|
||||
|
||||
```bash
|
||||
npm view ecc-universal dist-tags --json
|
||||
npm view ecc-universal@2.2.1 version dist.integrity
|
||||
gh release view v2.2.1 --repo affaan-m/ECC
|
||||
npx --yes ecc-universal@2.2.1 setup --help
|
||||
npx --yes ecc-universal@latest setup --help
|
||||
```
|
||||
|
||||
Expected:
|
||||
|
||||
- both exact-version and `latest` resolve to `2.2.1`;
|
||||
- registry integrity matches the workflow output;
|
||||
- the GitHub Release exists and uses the reviewed notes;
|
||||
- both package invocations return the guided setup help;
|
||||
- the native Claude marketplace path remains installable.
|
||||
|
||||
Treat an HTTP failure, integrity mismatch, missing public binary, or failed
|
||||
disposable install as critical.
|
||||
|
||||
## Rollback
|
||||
|
||||
If `2.2.1` has an install-critical regression, an authorized npm owner restores
|
||||
the known installable fallback immediately:
|
||||
|
||||
```bash
|
||||
npm dist-tag add ecc-universal@2.2.0 latest
|
||||
npm view ecc-universal dist-tags --json
|
||||
ECC_ROLLBACK_ROOT=$(mktemp -d)
|
||||
npm install --ignore-scripts --prefix "$ECC_ROLLBACK_ROOT" ecc-universal@2.2.0
|
||||
node "$ECC_ROLLBACK_ROOT/node_modules/ecc-universal/scripts/ecc.js" --help
|
||||
gh release edit v2.2.0 --repo affaan-m/ECC --latest
|
||||
```
|
||||
|
||||
Then open a release incident, state that `2.2.1` remains available only by
|
||||
exact version while the incident is investigated, and repair forward with a new
|
||||
patch version. Do not unpublish either package version and do not reuse the
|
||||
`v2.2.1` tag.
|
||||
56
docs/releases/2.2.1/release-notes.md
Normal file
56
docs/releases/2.2.1/release-notes.md
Normal file
@@ -0,0 +1,56 @@
|
||||
# ECC 2.2.1
|
||||
|
||||
ECC 2.2.1 is the signed ECC 2.2 patch release. It keeps the published `v2.2.0`
|
||||
history immutable while shipping the reviewed release-surface hardening that
|
||||
landed after the original 2.2.0 tag.
|
||||
|
||||
## Installer and release-surface hardening
|
||||
|
||||
- Public and packaged install docs now consistently point at the published
|
||||
`ecc-universal` commands instead of stale or unrelated package names.
|
||||
- The AdaL adapter docs use the correct `npx ecc-universal doctor --target adal`
|
||||
command.
|
||||
- Claude setup preflights `git` before provider-specific work starts, so missing
|
||||
prerequisites fail fast with the right action.
|
||||
- Guided setup dry runs use isolated HOME, config, XDG, temp, and Windows app
|
||||
data roots to avoid ambient host state affecting review or tests.
|
||||
- The exact packed artifact now has stronger lifecycle coverage for Claude and
|
||||
Kimi setup, update, doctor, repeat install, uninstall, and dry-run flows.
|
||||
- Identifier regression coverage blocks stale `ecc`, `ecc-install`, and other
|
||||
mismatched release-path commands from creeping back into user-facing docs.
|
||||
|
||||
## Current-main documentation included in this patch
|
||||
|
||||
- The canonical Itô workflow now documents `ecc ito accept <ticket-id>` and the
|
||||
`ito_accept` MCP tool.
|
||||
- Acceptance is explicitly bounded to buyer-authority routing. It routes the
|
||||
active desk quote to human review and does not claim to place a trade.
|
||||
|
||||
## Provenance boundary
|
||||
|
||||
- `v2.2.1` is intended to be a signed annotated tag on exact green `main`.
|
||||
- `v2.2.0` remains the immutable historical unsigned exception. Do not move,
|
||||
recreate, or reuse that tag.
|
||||
|
||||
## Upgrade
|
||||
|
||||
Install or update the published package, then run the same ECC command path you
|
||||
already use:
|
||||
|
||||
```bash
|
||||
npm install -g ecc-universal@2.2.1
|
||||
ecc doctor
|
||||
```
|
||||
|
||||
For first-time or guided terminal setup:
|
||||
|
||||
```bash
|
||||
npx ecc-universal setup
|
||||
```
|
||||
|
||||
The native Claude marketplace path remains supported:
|
||||
|
||||
```text
|
||||
/plugin marketplace add https://github.com/affaan-m/ECC
|
||||
/plugin install ecc@ecc
|
||||
```
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
Bu, yazılım geliştirme için 68 özel agent, 286 skill, 94 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**.
|
||||
|
||||
**Sürüm:** 2.2.0
|
||||
**Sürüm:** 2.2.1
|
||||
|
||||
## Temel İlkeler
|
||||
|
||||
|
||||
@@ -79,7 +79,7 @@ Bu repository yalnızca ham kodu içerir. Rehberler her şeyi açıklıyor.
|
||||
|
||||
## Yenilikler
|
||||
|
||||
### v2.2.0 — Rehberli Çoklu Harness Kurulumu (Ağu 2026)
|
||||
### v2.2.1 — Rehberli Çoklu Harness Kurulumu (Ağu 2026)
|
||||
|
||||
Claude Code, Codex ve Kimi Code için incelenebilir çoklu harness kurulumu ve eşitlenmiş npm komut girişi eklendi.
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、286 项技能、94 条命令以及自动化钩子工作流，用于软件开发。
|
||||
|
||||
**版本:** 2.2.0
|
||||
**版本:** 2.2.1
|
||||
|
||||
## 核心原则
|
||||
|
||||
|
||||
@@ -81,7 +81,7 @@
|
||||
|
||||
## 最新动态
|
||||
|
||||
### v2.2.0 — 引导式多 Harness 安装（2026年8月）
|
||||
### v2.2.1 — 引导式多 Harness 安装（2026年8月）
|
||||
|
||||
新增可审查的 Claude Code、Codex 与 Kimi Code 多 Harness 安装流程，并提供同步的 npm 命令入口。
|
||||
|
||||
@@ -1292,7 +1292,7 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以
|
||||
| **上下文文件** | CLAUDE.md + AGENTS.md | AGENTS.md | AGENTS.md | AGENTS.md |
|
||||
| **秘密检测** | 基于钩子 | beforeSubmitPrompt 钩子 | 基于沙箱 | 基于钩子 |
|
||||
| **自动格式化** | PostToolUse 钩子 | afterFileEdit 钩子 | N/A | file.edited 钩子 |
|
||||
| **版本** | 插件 | 插件 | 参考配置 | 2.2.0 |
|
||||
| **版本** | 插件 | 插件 | 参考配置 | 2.2.1 |
|
||||
|
||||
**关键架构决策：**
|
||||
|
||||
|
||||
4
package-lock.json
generated
4
package-lock.json
generated
@@ -1,12 +1,12 @@
|
||||
{
|
||||
"name": "ecc-universal",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "ecc-universal",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@iarna/toml": "2.2.5",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "ecc-universal",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"description": "Harness-native agent operating system for Codex, OpenCode, Cursor, Gemini, Claude Code, and terminal workflows - skills, hooks, rules, MCP conventions, and operator control-plane patterns",
|
||||
"publishConfig": {
|
||||
"access": "public"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "ecc",
|
||||
"version": "2.2.0",
|
||||
"version": "2.2.1",
|
||||
"description": "Harness-native ECC workflows for Codex: shared skills, production-ready MCP configs, and selective-install-aligned conventions for TDD, security scanning, code review, and autonomous development.",
|
||||
"author": {
|
||||
"name": "Affaan Mustafa",
|
||||
@@ -10,7 +10,16 @@
|
||||
"homepage": "https://ecc.tools",
|
||||
"repository": "https://github.com/affaan-m/ECC",
|
||||
"license": "MIT",
|
||||
"keywords": ["codex", "agents", "skills", "tdd", "code-review", "security", "workflow", "automation"],
|
||||
"keywords": [
|
||||
"codex",
|
||||
"agents",
|
||||
"skills",
|
||||
"tdd",
|
||||
"code-review",
|
||||
"security",
|
||||
"workflow",
|
||||
"automation"
|
||||
],
|
||||
"skills": "../../skills/",
|
||||
"mcpServers": "../../.mcp.json",
|
||||
"interface": {
|
||||
@@ -19,7 +28,11 @@
|
||||
"longDescription": "ECC is a harness-native operator system for Codex and adjacent agent harnesses. It packages reusable skills, MCP configs, TDD workflows, security scanning, code review, architecture decisions, operator workflows, and release gates in one installable plugin.",
|
||||
"developerName": "Affaan Mustafa",
|
||||
"category": "Coding",
|
||||
"capabilities": ["Interactive", "Read", "Write"],
|
||||
"capabilities": [
|
||||
"Interactive",
|
||||
"Read",
|
||||
"Write"
|
||||
],
|
||||
"websiteURL": "https://ecc.tools",
|
||||
"privacyPolicyURL": "https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement",
|
||||
"termsOfServiceURL": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service",
|
||||
|
||||
@@ -117,6 +117,13 @@ When preparing a release:
|
||||
3. Generate changelog from PR titles
|
||||
4. Create release: `gh release create`
|
||||
|
||||
For the ECC repository's maintainer release path, especially `ECC-031` and any
|
||||
follow-up where tag identity, npm provenance, and announcement evidence must
|
||||
all line up, read [references/ecc-release-checklist.md](references/ecc-release-checklist.md)
|
||||
before mutating tags, npm dist-tags, or GitHub Releases. That checklist
|
||||
captures the exact-green-main, signed-tag, registry-readback, and announcement
|
||||
requirements that the generic examples below do not.
|
||||
|
||||
```bash
|
||||
# List merged PRs since last release
|
||||
gh pr list --state merged --base main --search "merged:>2026-03-01"
|
||||
|
||||
211
skills/github-ops/references/ecc-release-checklist.md
Normal file
211
skills/github-ops/references/ecc-release-checklist.md
Normal file
@@ -0,0 +1,211 @@
|
||||
# ECC Signed Patch Release Checklist
|
||||
|
||||
Use this when releasing `affaan-m/ECC`, especially for `ECC-031` or any follow-up
|
||||
where the Git tag identity, npm provenance, GitHub Release, and announcement
|
||||
evidence all need to align.
|
||||
|
||||
## Milestone And Contract
|
||||
|
||||
- Milestone: `M0` in the ECC 2.2 release train.
|
||||
- Contract: ship one exact, verified artifact, keep ECC authority over release
|
||||
evidence and canonical state, and do not blur current shipped behavior with
|
||||
future plans.
|
||||
- Current gate: close the unsigned `v2.2.0` exception by releasing a new signed
|
||||
`2.2.x` patch from exact green `main`.
|
||||
|
||||
## Non-Negotiable Invariants
|
||||
|
||||
- Never move, recreate, or reuse `v2.2.0`.
|
||||
- The new patch tag must be a signed annotated tag on exact green `origin/main`.
|
||||
- Publish only the archive packed and verified by the release workflow.
|
||||
- Treat any non-`E404` npm lookup failure as blocking.
|
||||
- Do not manually promote `latest`, replace release assets, or publish different
|
||||
bytes under the same version.
|
||||
- Keep Itô and Nasiko wording bounded to shipped behavior only.
|
||||
|
||||
## ECC-031 State To Refresh Before Mutating
|
||||
|
||||
As of 2026-08-31:
|
||||
|
||||
- `v2.2.0` is live and latest, but `git tag -v v2.2.0` returns
|
||||
`error: no signature found`.
|
||||
- `main` currently points at `a104765bf20fd1480a3dd30f514f18f73ca80b8a`.
|
||||
- Exact-main CI run `33429642769` is green.
|
||||
- Exact-main CodeQL run `33429641766` is green.
|
||||
- No remote tag, GitHub Release, or npm publication exists for `2.2.1`.
|
||||
- `package.json` on `main` still declares `2.2.0`, so a reviewed version-prep
|
||||
change must land before the signed tag can be pushed.
|
||||
|
||||
Refresh those facts before mutating:
|
||||
|
||||
```bash
|
||||
git fetch origin main --tags
|
||||
git rev-parse origin/main
|
||||
gh run view 33429642769 --repo affaan-m/ECC --json status,conclusion,url
|
||||
gh run view 33429641766 --repo affaan-m/ECC --json status,conclusion,url
|
||||
gh release view v2.2.0 --repo affaan-m/ECC --json tagName,targetCommitish,publishedAt,url
|
||||
git ls-remote --tags origin 'refs/tags/v2.2.0*'
|
||||
git tag -v v2.2.0
|
||||
npm view ecc-universal dist-tags --json
|
||||
```
|
||||
|
||||
## Checklist
|
||||
|
||||
### 1. Reconfirm The Release Surface
|
||||
|
||||
- Verify the release commit you intend to tag is exact `origin/main`.
|
||||
- Verify required hosted checks on that exact `main` commit are green.
|
||||
- Verify no overlapping release-surface PR or hotfix needs to land first.
|
||||
- Record the exact `main` SHA you are about to build from.
|
||||
|
||||
```bash
|
||||
gh pr list --repo affaan-m/ECC --state open --limit 20
|
||||
gh run list --repo affaan-m/ECC --branch main --limit 10
|
||||
git fetch origin main --tags
|
||||
git switch main
|
||||
git pull --ff-only origin main
|
||||
git status --short
|
||||
git rev-parse HEAD
|
||||
git rev-parse origin/main
|
||||
```
|
||||
|
||||
Stop if:
|
||||
|
||||
- `HEAD` differs from `origin/main`;
|
||||
- any required `main` run is red or still pending;
|
||||
- a new release-surface merge materially changes the patch contents.
|
||||
|
||||
### 2. Choose The Patch Version And Confirm It Is Unused
|
||||
|
||||
Expected next version is `2.2.1` unless it already exists.
|
||||
|
||||
```bash
|
||||
VERSION=2.2.1
|
||||
git ls-remote --tags origin "refs/tags/v${VERSION}*"
|
||||
gh release view "v${VERSION}" --repo affaan-m/ECC
|
||||
npm view "ecc-universal@${VERSION}" version
|
||||
```
|
||||
|
||||
Expected:
|
||||
|
||||
- no remote tag;
|
||||
- no GitHub Release;
|
||||
- npm returns `E404`.
|
||||
|
||||
### 3. Prepare The Patch-Release PR
|
||||
|
||||
- Branch from exact current `main`.
|
||||
- Update release metadata to the new patch version.
|
||||
- Add reviewed release notes under `docs/releases/<version>/release-notes.md`.
|
||||
- Add a patch runbook under `docs/releases/<version>/launch-runbook.md`.
|
||||
- Open and merge that prep PR.
|
||||
- Wait for fresh `main` CI and CodeQL on the merged prep commit.
|
||||
|
||||
Important:
|
||||
|
||||
- Do **not** use `scripts/release.sh` as-is for `ECC-031`.
|
||||
- That script still commits, tags, and pushes in one shot, which bypasses the
|
||||
required `merge -> exact main CI green -> signed tag push` boundary.
|
||||
- PAT-backed GitHub access is not enough. The release operator also needs a
|
||||
locally available signing identity before creating the tag.
|
||||
|
||||
Minimum prep checks:
|
||||
|
||||
```bash
|
||||
node tests/plugin-manifest.test.js
|
||||
node tests/scripts/build-opencode.test.js
|
||||
node tests/ci/release-packed-artifact-workflow.test.js
|
||||
```
|
||||
|
||||
### 4. Wait For Exact Main To Turn Green Again
|
||||
|
||||
After the prep PR merges, the new `main` commit becomes the only commit you may
|
||||
tag.
|
||||
|
||||
```bash
|
||||
gh run list --repo affaan-m/ECC --branch main --limit 10
|
||||
gh run view RUN_ID --repo affaan-m/ECC --json status,conclusion,url
|
||||
git fetch origin main --tags
|
||||
git switch main
|
||||
git pull --ff-only origin main
|
||||
git rev-parse HEAD
|
||||
git rev-parse origin/main
|
||||
```
|
||||
|
||||
### 5. Create And Push The Signed Tag
|
||||
|
||||
From a clean `main` checkout on the exact green commit:
|
||||
|
||||
```bash
|
||||
VERSION=2.2.1
|
||||
git fetch origin main --tags
|
||||
git switch main
|
||||
git pull --ff-only origin main
|
||||
git status --short
|
||||
git rev-parse HEAD
|
||||
git rev-parse origin/main
|
||||
git tag -s "v${VERSION}" -m "ECC ${VERSION}" HEAD
|
||||
git tag -v "v${VERSION}"
|
||||
git push origin "refs/tags/v${VERSION}"
|
||||
```
|
||||
|
||||
Required proof:
|
||||
|
||||
- clean worktree;
|
||||
- `HEAD == origin/main`;
|
||||
- `git tag -v` succeeds locally before push.
|
||||
|
||||
### 6. Watch The Release Workflow
|
||||
|
||||
The tag push should trigger `.github/workflows/release.yml`, which must:
|
||||
|
||||
1. prove the tag commit equals `origin/main`;
|
||||
2. validate version and manifests;
|
||||
3. run IOC and payload checks;
|
||||
4. pack one archive and record its SHA-256;
|
||||
5. verify that exact archive on Linux, macOS, and Windows;
|
||||
6. publish to npm under `staged` with provenance;
|
||||
7. read back `dist.integrity` and compare it to the tested archive;
|
||||
8. promote the verified version to `latest`;
|
||||
9. create the GitHub Release from reviewed notes.
|
||||
|
||||
### 7. Perform Mandatory Public Readback And Canaries
|
||||
|
||||
After the workflow succeeds:
|
||||
|
||||
```bash
|
||||
VERSION=2.2.1
|
||||
npm view ecc-universal dist-tags --json
|
||||
npm view "ecc-universal@${VERSION}" name version dist.integrity --json
|
||||
gh release view "v${VERSION}" --repo affaan-m/ECC \
|
||||
--json tagName,name,isDraft,isPrerelease,publishedAt,url
|
||||
gh api repos/affaan-m/ECC/releases/latest --jq .tag_name
|
||||
npx --yes "ecc-universal@${VERSION}" setup --help
|
||||
npx --yes ecc-universal@latest setup --help
|
||||
```
|
||||
|
||||
Also run the clean install, doctor, repair, uninstall, and rollback canaries
|
||||
required by the checked-in runbook, and verify the native Claude marketplace
|
||||
path remains installable:
|
||||
|
||||
```text
|
||||
/plugin marketplace add https://github.com/affaan-m/ECC
|
||||
/plugin install ecc@ecc
|
||||
```
|
||||
|
||||
### 8. Verify Announcement Delivery
|
||||
|
||||
- One `Announcements` Discussion exists for the new tag.
|
||||
- It uses the GitHub Release body and URL.
|
||||
- Discord delivery is evidenced by the workflow receipt.
|
||||
- No duplicate Discussion or Discord message was created.
|
||||
|
||||
### 9. Record Evidence And Close Out ECC-031
|
||||
|
||||
- Complete the release evidence record with actual SHAs, workflow URLs, release
|
||||
URLs, npm integrity, and announcement state.
|
||||
- Update the dashboard ticket and release docs with the final patch tag and
|
||||
proof URLs.
|
||||
- Keep `v2.2.0` documented as the historical unsigned exception.
|
||||
- Mark `ECC-031` resolved only after the signed patch release is public and
|
||||
every required gate above is backed by evidence.
|
||||
Reference in New Issue
Block a user