CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-21 12:20:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: add production runtime RC release channel

Browse Source 
Publish signed prerelease artifacts from v2.0.0-rc.* tags, bind bootstrap trust to the immutable RC tag, make missing-release errors actionable, and install the six public skills from the canonical subpath.
This commit is contained in:
Sinabina
2026-07-20 16:51:59 -07:00
parent d6ef673e4d
commit b0047cc525
84 changed files with 367 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/gstack-2/RELEASE-INTEGRITY.md
+13 -4
View File
@@ -5,10 +5,11 @@ GStack has two explicit version identities during the 2.0 migration:
- `VERSION` and `package.json.version` are the repository/package release
counter. They remain byte-equal and retain the existing four-slot format so
the 1.x compatibility ship queue does not silently fail open.
- `package.json.gstack.runtimeVersion`, `runtime/index.js`,
`runtime/install.js`, and every standards-installed bootstrap declare the
managed-runtime protocol release `2.0.0`. The official artifact tag and
manifest use that value.
- `package.json.gstack.runtimeVersion`, `runtime/index.js`, and
`runtime/install.js` declare the managed-runtime protocol release `2.0.0`.
Each standards-installed bootstrap separately pins one immutable artifact
release tag. Candidate bootstraps use `v2.0.0-rc.N`; the manifest and bundle
remain runtime-compatible with `2.0.0`. Stable bootstraps use `v2.0.0`.
They are intentionally different namespaces. CI fails if either identity
drifts inside its own namespace.
@@ -24,6 +25,14 @@ linux-arm64 linux-x64 (glibc)
windows-arm64 windows-x64
```
Both `v2.0.0-rc.*` and `v2.0.0` tags use the same build, signing, manifest,
attestation, and smoke path. RC tags publish GitHub prereleases so the exact
fresh-machine production bootstrap can be exercised before the stable tag is
created. Runtime compatibility and release-channel identity are deliberately
separate: archive names and manifest `version` remain `2.0.0`, while URLs and
Sigstore certificate identity bind to the immutable RC or stable tag that
actually published them.
Each archive has one `gstack/` root and no symlinks. CI records an exact byte
count and SHA-256, signs the archive keylessly with Cosign, emits a Sigstore
bundle, and also creates a GitHub build-provenance attestation. The release