Merge pull request #142 from NDDev-OpenNetwork/fix/release-onboarding-093

fix: stabilize device onboarding and refresh release tools

Author: rldyourmnd

.gds/bundle.lock.yaml

@@ -2,17 +2,17 @@
 schema_version: 1
 
 bundle:
-  version: "0.9.2-dev"
+  version: "0.9.3-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:0c885d2d0f12f74a4ea83a0cfcdab9d7458c815a89bb555f8dfe8aa8030b5366"
-  digest: "sha256:0442b90d82ad533ad4cc3e8647f3948dc00feddd2dd529f6665ee4baa59f4419"
+  source_tree_digest: "sha256:dbbd338cb723846e6f140f16fd2e76594fea9377bf792c03fbae60a54e88ee01"
+  digest: "sha256:d8b7f50891831664b429e19e5df040fcc7e1fd6d1b544cf8c8ebf3147cc2afef"
 
 projection:
-  input_digest: "sha256:6990797ab8ff381018560945ee46b08f218e45c29d9330611e4aedc72269ea81"
-  output_digest: "sha256:6e34a0f22dbff41e27b75cee5aee8166b00acea9573fed77ca622e9e4209e6cc"
+  input_digest: "sha256:a56667c2156bdae3807b57a647c5f92c07223bf37b0edefbb4a50eb0038bd3e1"
+  output_digest: "sha256:5a94f145b67e94ed66d769850bed7a5e2a9ea29439d5aebcd400fab18eb49ec1"
   files:
     - path: ".gds/compiled-policy.json"
-      digest: "sha256:f22de75f2bb598a052f336948b85dbcf10c368d83dca323b518eee96ff6f8d42"
+      digest: "sha256:26f4268e1b6df625045487c49b80342e94c5c6a81f2d8dc966f1a3a05021ac37"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:e2c0d4349fe9b3cfba25794893c7aeda31e92347cb367484d83aaf2aea50828d"
+      digest: "sha256:e12974ce96d1fccf477eaab11d2def7a22240df5d0a4e5bfb78c5c2b70e8fc7d"

.gds/compiled-policy.json

@@ -2,8 +2,8 @@
   "schema_version": 1,
   "compiled_policy": {
     "repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG",
-    "bundle_version": "0.9.2-dev",
-    "digest": "sha256:dafc90cc077d4cf850bdf756eb99a6bfb7c532832c0fc43fb4fa8d60ded37d69"
+    "bundle_version": "0.9.3-dev",
+    "digest": "sha256:497a28d43aad2a561c0144598da07c453bd1d48de59f02a5321c88f03f27e291"
   },
   "sources": [
     {

.gds/repository.yaml

@@ -77,11 +77,11 @@ git:
 
 ci:
   profile: "go"
-  go_version: "1.26.7"
+  go_version: "1.27.1"
   build_command: "go build -trimpath ./core/cmd/gds"
   test_command: "go test ./..."
   timeout_minutes: 30
-  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05"
+  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7"
   # A public repository, so GitHub-hosted runners are unmetered and a fork's
   # pull request cannot reach anything of ours. Self-hosted hardware here would
   # turn a fork PR into remote code execution on it.
@@ -109,8 +109,8 @@ verification:
     - "test"
     - "build"
   required_contexts:
-    - "GDS fast / go (1.26.7)"
-    - "GDS PR required / go (1.26.7)"
+    - "GDS fast / go (1.27.1)"
+    - "GDS PR required / go (1.27.1)"
 
 agent:
   context_profile: "project-default"

.github/rulesets/branch-main.json

@@ -46,10 +46,10 @@
         "do_not_enforce_on_create": false,
         "required_status_checks": [
           {
-            "context": "GDS fast / go (1.26.7)"
+            "context": "GDS fast / go (1.27.1)"
           },
           {
-            "context": "GDS PR required / go (1.26.7)"
+            "context": "GDS PR required / go (1.27.1)"
           }
         ]
       }

.github/workflows/gds-ci.yml

@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
-# bundle: 0.9.2-dev
-# source-tree-digest: sha256:0c885d2d0f12f74a4ea83a0cfcdab9d7458c815a89bb555f8dfe8aa8030b5366
-# input-digest: sha256:6990797ab8ff381018560945ee46b08f218e45c29d9330611e4aedc72269ea81
-# output-digest: sha256:8c045e745cc69b731bc695a4a9d58a48c10f1ab7dd85b7354db7bfd0e072711c
+# bundle: 0.9.3-dev
+# source-tree-digest: sha256:dbbd338cb723846e6f140f16fd2e76594fea9377bf792c03fbae60a54e88ee01
+# input-digest: sha256:a56667c2156bdae3807b57a647c5f92c07223bf37b0edefbb4a50eb0038bd3e1
+# output-digest: sha256:15b87303cd0692fd8e5d88281771dded9fdc2fc027d600681155cb4e71f42386
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -34,15 +34,15 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
       # workflow owns cache keys and invalidation, so no runner-local state is trusted.
       cache: true
 
       runner: "ubuntu-latest"
-      go_version: "1.26.7"
+      go_version: "1.27.1"
       # Declared fast commands own their build scope; the complete build is below.
       build_command: ""
       test_command: "scripts/validate_shell.sh && scripts/validate_go_core.sh --fast"
@@ -54,12 +54,12 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7
     with:
       fetch_depth: 0
       cache: true
       runner: "ubuntu-latest"
-      go_version: "1.26.7"
+      go_version: "1.27.1"
       build_command: "go build -trimpath ./core/cmd/gds"
       test_command: "go test ./... && python3 -m pip install --quiet --require-hashes -r requirements/test.txt && python3 -m pytest"
       timeout_minutes: 30

.github/workflows/platforms.yml

@@ -35,9 +35,8 @@ jobs:
     # `macos-latest` is Apple Silicon, so it covers darwin/arm64. `ubuntu-24.04-arm`
     # covers linux/arm64. Both are standard hosted runners and unmetered on public
     # repositories; macOS-XL and larger runners are billed even here and are not used.
-    # darwin/amd64 stays uncovered: it needs `macos-13`, the last Intel image, whose
-    # retirement is already announced — worth adding only if that target is still
-    # shipped when this is next revisited.
+    # Standard Intel macOS runners remain available as macos-15-intel. Together
+    # with the main Linux X64 workflow these jobs execute all four shipped targets.
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 20
@@ -51,6 +50,8 @@ jobs:
             runner: macos-latest
           - name: linux-arm64
             runner: ubuntu-24.04-arm
+          - name: darwin-amd64
+            runner: macos-15-intel
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/release-bundle.yml

@@ -56,7 +56,7 @@ jobs:
     permissions:
       contents: read
     env:
-      GOTOOLCHAIN: go1.26.7
+      GOTOOLCHAIN: go1.27.1
       VERSION: ${{ inputs.version }}
       RELEASE_SEQUENCE: ${{ inputs.release_sequence }}
       CHANNEL: ${{ inputs.channel }}
@@ -74,7 +74,7 @@ jobs:
       - name: Install exact Go toolchain
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.7"
+          go-version: "1.27.1"
           cache: true
 
       - name: Run release gates

README.md

@@ -37,8 +37,8 @@ topology.
 ## Local development
 
 ```bash
-GOTOOLCHAIN=go1.26.7 go build -trimpath -o /tmp/gds ./core/cmd/gds
-GOTOOLCHAIN=go1.26.7 go build -trimpath -o /tmp/gds-codex-runtime-driver \
+GOTOOLCHAIN=go1.27.1 go build -trimpath -o /tmp/gds ./core/cmd/gds
+GOTOOLCHAIN=go1.27.1 go build -trimpath -o /tmp/gds-codex-runtime-driver \
   ./core/cmd/gds-codex-runtime-driver
 /tmp/gds --json context
 /tmp/gds --json status

core/README.md

@@ -132,7 +132,7 @@ Root pytest discovery is limited by `pytest.ini` to `tests/`; it never collects
 tests from independent workspace repositories. The full Go validator
 runs module integrity, vet, unit/integration/race tests, schemas, and CGo-free
 cross-builds for macOS and Linux on arm64 and amd64. It requires the exact
-source-registered release builder (`go1.26.7`). Quick validation may run on an
+source-registered release builder (`go1.27.1`). Quick validation may run on an
 older local toolchain but leaves release evidence `NOT_PROVEN`.
 
 `gds-assurance` is a separate release-gate binary. It requires a clean source

core/app/module_verify_lanes_test.go

@@ -30,6 +30,9 @@ func TestCleanupPendingStopsLaterLanesInSource(t *testing.T) {
 }
 
 func TestFailedRemoveWorktreeDoesNotDeleteWorkspace(t *testing.T) {
+	// Production must retain a checkout whose removal was not proven. Keep that
+	// deliberately retained fixture inside the test's own temporary lifetime.
+	t.Setenv("TMPDIR", t.TempDir())
 	root, oid := moduleVerifyRepository(t)
 	runner, err := gitprovider.NewMutationRunner()
 	if err != nil {
@@ -60,6 +63,10 @@ func TestFailedRemoveWorktreeDoesNotDeleteWorkspace(t *testing.T) {
 	if !foundCleanup {
 		t.Fatalf("cleanup finding missing: %#v", findings)
 	}
+	retained, err := filepath.Glob(filepath.Join(os.TempDir(), "gds-module-verify-*", "checkout", "fixture.txt"))
+	if err != nil || len(retained) != 1 {
+		t.Fatalf("failed cleanup did not preserve the workspace: %v, %v", retained, err)
+	}
 }
 
 func TestFailedRemoveWorktreeSourceContract(t *testing.T) {