Repository navigation
chore(release): 0.9.63 - verified provenance for every download - #257
Merged
Merged
Conversation
Bumps package.json, the Helm chart (0.1.24 / appVersion 0.9.63) and the operator OLM bundle together, which the two release gates require. The chart's artifacthub.io/changes entries are hand-written per chart release, as before: this one tracks the app release and records that no template changed, so the rendered manifests are identical to 0.1.23. Adds the 0.9.63 entry to the Flathub AppStream metainfo. The FlatPark one is deliberately left alone: its newest release must equal the version its manifest pins as extra-data, and that pin cannot move to 0.9.63 until the GUI Debian package exists - both are updated in the usual post-release follow-up commit.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release bump for 0.9.63 (chart 0.1.24, appVersion 0.9.63). Merge this, and the tag push follows.
What 0.9.63 ships (since 0.9.62)
Supply chain, end to end:
feat(release): every release asset and the GHCR image carry SLSA provenance attestations (feat(release): attest every release asset and the GHCR image with SLSA provenance #250)feat(release): the npm tarball is published with Sigstore provenance (feat(release): publish the npm tarball with Sigstore provenance #248)feat(npx): the launcher verifies the downloaded archive's provenance before starting (feat(npx): verify the downloaded archive's provenance before starting #253)Editor and connections:
fix(editor): Monaco is served from our own origin, so the workspace works air-gapped (fix(editor): serve Monaco from our own origin so the workspace works air-gapped #251)fix(editor): the Monaco Explain action stays in step with the active provider (fix(editor): keep the Monaco Explain action in step with the active provider #256)fix(connections): SQLite is offered in the connection-form type picker (fix(connections): offer SQLite in the connection form type picker #249)Release infrastructure and distribution:
fix(helm): an already-released chart version is never re-published (fix(helm): never re-publish an already-released chart version (#167) #255, closes helm-release: chart-content merge without version bump re-publishes index/OCI for an already-released chart version #167)feat(distribution): FlatPark is live; Flathub marked deprecated and Flatpak users routed to FlatPark (docs(distribution): mark Flathub deprecated and route Flatpak users to FlatPark #252)docs: the first-run admin setup RFC landed, and the GUI Debian package is surfaced in the READMEWhat this PR changes
The three bump surfaces the release gates require, plus one AppStream entry:
package.json0.9.62 -> 0.9.63charts/libredb-studio/+operator/helm-charts/libredb-studio/(bun run chart:bump): chart 0.1.24, appVersion 0.9.63,artifacthub.io/imagestag, README--versionexamples, operator copy refreshedoperator/bundle/+operator/config/manager/kustomization.yaml(make -C operator bundle): CSVlibredb-studio-operator.v0.9.63, controller image tag 0.9.63packaging/flatpak/org.libredb.Studio.metainfo.xml: 0.9.63 release entryTwo deliberate omissions:
artifacthub.io/changesentries are hand-written per chart release (as in 0.1.23), not the generatedTrack app releaseline: this one tracks the app release and records that no template changed, so 0.1.24 renders identically to 0.1.23.packaging/flatpark/org.libredb.Studio.metainfo.xmlis left at 0.9.62 on purpose. Its newest<release>must equal the version the manifest pins as extra-data, and that pin cannot move until the 0.9.63 GUI Debian package exists -tests/unit/flatpark-descriptor.test.tsenforces exactly that pairing. Both move together in the usual post-release follow-up commit.Local pre-release validation (all green on this branch)
format,lint(0 errors),typecheck,knip,test(21 groups, 2915 tests),buildtest:coverage+coverage:check-> 25941/25941 lines (100.00%)build:lib+attw(node16 CJS/ESM and bundler green; node10 ignored by policy)helm lint --strictclean,chart:checkOK (chart 0.1.24 / appVersion 0.9.63 in sync)make -C operator bundleregenerated andoperator-sdk bundle validate --select-optional suite=operatorframeworkreports all tests completed (the two v1.25 API-deprecation warnings are pre-existing)distribution:checkexits 0; every DRIFT row is anon_demandPaaS channel already tracked in Dokploy template: bump pinned image from 0.9.27 to current release #175