feat(release): per-build prerelease lane + release-notes generator (RIG-2914) - #711
Open
rigel-mintaka wants to merge 1 commit into
Open
feat(release): per-build prerelease lane + release-notes generator (RIG-2914)#711rigel-mintaka wants to merge 1 commit into
rigel-mintaka wants to merge 1 commit into
Conversation
…IG-2914) Stand up the keystone of the compass distribution rail (T1+T2 of the frozen compass-release-bundling record): a per-build GitHub Release lane and the release-body / nix-outputs manifest generator it consumes. - .github/workflows/release.yml: a separate `contents: write`-only workflow (NOT packages:write) that, on a binary-affecting push to main (go/**, versions/go.nix, self) or workflow_dispatch, builds the four binaries (compass/-server/-runner linux-amd64 + compass darwin-arm64, CGO-free, -trimpath, one `-X main.version=0.1.0+g<sha12>` stamp), writes SHA256SUMS, and cuts an idempotent `build-<sha12>` prerelease. No pull_request trigger and a main-ref guard keep fork-PR code away from the write token; concurrency serializes releases; the nix caches are named inline (no accept-flake-config); the fork skopeo and the language toolchains are provisioned from the pinned nix helpers. - tools/release-notes/: a bun/TS tool with a pure, unit-tested core (`assemble`, `classifyImageResult`, `parseArgs`) behind an import.meta.main edge. It queries GHCR for the image config digest (degrading to a recorded-absence line when the image lane has not published this sha) and records the nix build-output identity via `nix path-info`. Acceptance note: the first real Release is minted by the first qualifying main push AFTER this merges — a `contents: write` workflow does not run on the PR event by design, so the absence of a Release on this PR is expected, not a failure. Refs RIG-2914 Refs RIG-1746 Ledger-impact: none (implements frozen record docs/designs/platform/compass-release-bundling.md §Plan T1/T2; no design-record edit) Co-authored-by: Matt Wilkinson <matt@rigel.build>
|
Compass engineering docs preview: https://compass-native-rig-2914-rele.compass-eng-docs.pages.dev Deployed from |
rigel-mintaka
marked this pull request as ready for review
August 28, 2026 04:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stand up the keystone of the compass distribution rail (T1+T2 of the
frozen compass-release-bundling record): a per-build GitHub Release lane
and the release-body / nix-outputs manifest generator it consumes.
contents: write-onlyworkflow (NOT packages:write) that, on a binary-affecting push to main
(go/**, versions/go.nix, self) or workflow_dispatch, builds the four
binaries (compass/-server/-runner linux-amd64 + compass darwin-arm64,
CGO-free, -trimpath, one
-X main.version=0.1.0+g<sha12>stamp),writes SHA256SUMS, and cuts an idempotent
build-<sha12>prerelease.No pull_request trigger and a main-ref guard keep fork-PR code away
from the write token; concurrency serializes releases; the nix caches
are named inline (no accept-flake-config); the fork skopeo and the
language toolchains are provisioned from the pinned nix helpers.
(
assemble,classifyImageResult,parseArgs) behind animport.meta.main edge. It queries GHCR for the image config digest
(degrading to a recorded-absence line when the image lane has not
published this sha) and records the nix build-output identity via
nix path-info.Acceptance note: the first real Release is minted by the first
qualifying main push AFTER this merges — a
contents: writeworkflowdoes not run on the PR event by design, so the absence of a Release on
this PR is expected, not a failure.
Refs RIG-2914
Refs RIG-1746
Ledger-impact: none (implements frozen record docs/designs/platform/compass-release-bundling.md §Plan T1/T2; no design-record edit)
Co-authored-by: Matt Wilkinson matt@rigel.build