From 3e72a8b3f91b7cb239d3e87c9955b6d65cc2feb2 Mon Sep 17 00:00:00 2001 From: daichunghy <112932824+daichunghy@users.noreply.github.com> Date: Sun, 23 Aug 2026 15:54:03 +0700 Subject: [PATCH] docs: publish beta5 release identity --- .github/SECURITY.md | 2 +- .github/SUPPORT.md | 3 +-- AGENTS.md | 18 +++++++++--------- README.md | 10 +++++----- docs/CHANGELOG.md | 4 ++++ docs/getting-started.md | 4 ++-- docs/github-action-usage.md | 10 +++++----- docs/releases/2026-08-23-beta.5.md | 12 ++++++++++++ docs/releases/beta-release-and-rollback.md | 2 +- 9 files changed, 40 insertions(+), 25 deletions(-) create mode 100644 docs/releases/2026-08-23-beta.5.md diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 0d6b1a8..4af77d3 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -4,7 +4,7 @@ | Version | Supported | |---|---| -| `v0.1.0-beta.4` / `0.1.0-dev` | Best effort during pre-release | +| `v0.1.0-beta.5` / `0.1.0-dev` | Best effort during pre-release | | Stable versions | None released yet | ## 2. Reporting a Vulnerability diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md index 82eb219..602af46 100644 --- a/.github/SUPPORT.md +++ b/.github/SUPPORT.md @@ -2,8 +2,7 @@ Thank you for using PatchGate. -PatchGate is a public pre-release (`0.1.0-dev`, Action tag `v0.1.0-beta.4`, commit -`d8c67a848a95d456707e6c580a43e4e56e6071a0`). +PatchGate is a public pre-release (`0.1.0-dev`, Action tag `v0.1.0-beta.5`). Support is **best effort**. There is no SLA for consumer questions, no on-call, and no promise that a maintainer will debug a specific repository's GitHub Ruleset, branch protection, or workflow graph. PatchGate reports diff --git a/AGENTS.md b/AGENTS.md index 0bc81fd..1444c1d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -98,14 +98,14 @@ readiness. | Area | Current evidence | Status and limit | | --- | --- | --- | -| G0 public foundation | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 license, Community Profile 100%, seven repository topics, Discussions, private vulnerability reporting, protected `main`, CI workflow, and successful public `main` CI runs | Foundation is present at public `main@d8c67a8`; `main` requires six CI contexts and one approving review, `0.1.0-dev` remains an unpublished package, and beta.4 is the current public Action pre-release. There is no downstream usage; maintainer-bypass merges remain recorded as maintainer decisions rather than independent-review evidence | +| G0 public foundation | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 license, Community Profile 100%, seven repository topics, Discussions, private vulnerability reporting, protected `main`, CI workflow, and successful public `main` CI runs | Foundation is present on public `main`; `main` requires six CI contexts and one approving review, `0.1.0-dev` remains an unpublished package, and beta.5 is the current public Action pre-release. There is no downstream usage; maintainer-bypass merges remain recorded as maintainer decisions rather than independent-review evidence | | G1 deterministic contract | TypeScript evaluator, schemas, receipt digests, recorded fixtures, security coverage, and deterministic tests | Locally verified; this does not prove a live GitHub integration | | G2 local preflight | `preflight`, `validate`, `init`, `doctor`, Git-ref loading, discovery classification, text/JSON parity, and six CLI process tests (the sixth covers the `evaluate --output` alias and its fail-closed conflict, PR #40) | Local user flow is verified; three consented usability sessions and UR acceptance evidence are still open | | G3 GitHub adapter | Recorded/mock authenticated snapshot flow, bounded requests, source and SHA binding, TOCTOU re-read, redaction, branch-protection and Rulesets subset contract, 25 integration tests and the latest recorded GET-only smoke for PR #9 head `5f9ccb5` | The tested head built a schema-valid live snapshot and receipt with final status `human_review_required`; missing approval/ownership/linkage evidence remains explicit; unsupported Ruleset semantics and merge-group membership remain fail-closed | | G4 Action | Root `action.yml`, `src/action/index.ts`, committed ncc bundle, pinned workflows, required CI/CodeQL merge-group triggers, clean-room bundle verification, idempotent check delivery including a neutral check run when the snapshot is rejected (PR #26), consumer fixture smoke and explicit non-ready merge-group handling are merged into `main` | Local consumer boundary is verified; no live external consumer E2E, production release or two consenting non-blocking shadow installations | -| User value and release | Protocols, roadmap, public Discussions, pilot request, contribution issues, public Project #1, merged hardening work and the `v0.1.0-beta.4` pre-release with a recorded shadow-installation no-go decision exist | No completed G2 sessions, external replies or contributions, external shadow installations, enforcement pilots, production release, or `v0.1` claim | +| User value and release | Protocols, roadmap, public Discussions, pilot request, contribution issues, public Project #1, merged hardening work and the `v0.1.0-beta.5` pre-release with a recorded shadow-installation no-go decision exist | No completed G2 sessions, external replies or contributions, external shadow installations, enforcement pilots, production release, or `v0.1` claim | -The public default branch is currently `main@d8c67a8`. [PR #9](https://github.com/daichunghy/patchgate/pull/9) +The public default branch is currently `main`; the current immutable Action commit is recorded on the beta.5 release page. [PR #9](https://github.com/daichunghy/patchgate/pull/9) and follow-ups #15–#21, #23, #25 and #26 were merged on 2026-08-22, and #28, #36 and #40 were merged on 2026-08-23, each by the repository administrator after temporarily lifting `enforce_admins`; the setting was @@ -121,7 +121,7 @@ and CodeQL `32563526929` on `main@e4052f2`, earlier runs through [32559824706](https://github.com/daichunghy/patchgate/actions/runs/32559824706) on `main@c9f643e`, and the first public run [CI 32333914059](https://github.com/daichunghy/patchgate/actions/runs/32333914059). -For `main@d8c67a8`, default-branch CI run +For the current public `main`, default-branch CI run [32616034636](https://github.com/daichunghy/patchgate/actions/runs/32616034636) completed successfully while CodeQL `32616034425` was still in progress when this snapshot was written. @@ -141,13 +141,13 @@ and #39 (`actions/checkout` 7) were merged on 2026-08-23 after green CI, and the split CodeQL 4.37.7 PRs #35/#37 were superseded by a combined init+analyze bump; the `create-check-run` default flip also shipped in that PR. Every merge used the recorded admin-bypass pattern and is a maintainer decision. The pre-release -[`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4) -is pinned to `main@d8c67a8` after a live maintainer smoke +[`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5) +is the current public beta after a live maintainer smoke ([daichunghy/patchgate-beta-smoke](https://github.com/daichunghy/patchgate-beta-smoke)) found and fixed a critical Action input-parsing bug that made `v0.1.0-beta.1` unusable on real runners ([findings](docs/reviews/2026-08-22-live-smoke-findings.md), -[release record](docs/releases/2026-08-23-beta.4.md)); it is beta +[release record](docs/releases/2026-08-23-beta.5.md)); it is beta shadow-evidence scope only — not production, adoption or a `v0.1` claim. The current milestone audit is [the 2026-08-20 G4/G0 continuation audit](docs/reviews/2026-08-20-g4-g0-audit.md). The newest records are the [2026-08-22 multi-persona review round](docs/reviews/2026-08-22-multi-persona-review.md), the [2026-08-22 live consumer smoke findings](docs/reviews/2026-08-22-live-smoke-findings.md) and the [2026-08-22 Mimosa static-advisory adjudication](docs/reviews/2026-08-22-mimosa-static-advisory-adjudication.md) — re-run the sealed scan after any change to `src/github/client.ts` transport handling. The latest verification command to rerun after a change is: @@ -212,14 +212,14 @@ produced by the adapter — not a raw GitHub event payload. Current allowed Action form (shadow only): ```yaml -- uses: daichunghy/patchgate@d8c67a848a95d456707e6c580a43e4e56e6071a0 +- uses: daichunghy/patchgate@v0.1.0-beta.5 with: fail-on: never create-check-run: true ``` `fail-on: blocked` is the enforcement form intended for the first stable -release, not for this pre-release. Pin the beta.4 full SHA above; older beta +release, not for this pre-release. Pin the beta.5 immutable release commit; older beta tags are superseded. The first supported rule classes are: diff --git a/README.md b/README.md index 181b804..50c7936 100644 --- a/README.md +++ b/README.md @@ -18,8 +18,8 @@ it cannot force external automation to stop working. **Status:** public pre-release. The npm package remains unpublished (`private: true`, `0.1.0-dev`). The current Action release is -[`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4), -and consumers should pin commit `d8c67a848a95d456707e6c580a43e4e56e6071a0` for +[`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5), +and consumers should pin the immutable commit shown on that release page for **shadow** evaluation only. This is not production, not a `v0.1` claim, and not evidence of external pilots or adoption. @@ -64,8 +64,8 @@ Longer walkthrough: [Getting started](docs/getting-started.md). ## GitHub Action candidate The Action is bundled for the repository's local shadow workflow. The tagged -pre-release [`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4) -is the current release; pin commit `d8c67a848a95d456707e6c580a43e4e56e6071a0` +pre-release [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5) +is the current release; pin its immutable commit SHA for shadow evaluation. Production consumers must still wait for a stable public release. Do not use the placeholder `patchgate/patchgate@v0.1.0-dev` as an installable public @@ -209,7 +209,7 @@ The repository maintains a clean root directory structure (9 files max) with mod - [Project constitution](docs/PROJECT_CONSTITUTION.md) - [Example policy](docs/patchgate.example.yml) - [Action usage guide](docs/github-action-usage.md) -- [v0.1.0-beta.4 release record](docs/releases/2026-08-23-beta.4.md) +- [v0.1.0-beta.5 release record](docs/releases/2026-08-23-beta.5.md) - [Contributing](.github/CONTRIBUTING.md) - [Security policy](.github/SECURITY.md) - [Code of conduct](.github/CODE_OF_CONDUCT.md) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 0df3abb..8748cc4 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -2,6 +2,10 @@ All notable changes to PatchGate will be documented in this file. +### Beta release — 2026-08-23 (`v0.1.0-beta.5`) +- Published the current documentation-synchronized beta from the public default branch. +- The Action behavior is unchanged from beta.4; consumers should pin the immutable release commit and keep shadow mode enabled. + ### Beta release — 2026-08-23 (`v0.1.0-beta.4`) - Released [`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4), pinned to `d8c67a848a95d456707e6c580a43e4e56e6071a0`. - Updated the consumer Action reference, default Check Run behavior, CLI `--output` alias, and full-SHA workflow pins. diff --git a/docs/getting-started.md b/docs/getting-started.md index f4edece..714865e 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -1,10 +1,10 @@ # Getting started PatchGate is a public pre-release. The npm package is unpublished -(`private: true`, `0.1.0-dev`). The current Action release is `v0.1.0-beta.4`, +(`private: true`, `0.1.0-dev`). The current Action release is `v0.1.0-beta.5`, which is for shadow evaluation only — not production, not a `v0.1` claim, and not evidence of external pilots. Pin commit -`d8c67a848a95d456707e6c580a43e4e56e6071a0`. +the immutable commit SHA shown on its release page. This walkthrough uses a clone and a local build. Do not run `npx patchgate`: that npm name is a different project. The direct GitHub install is available diff --git a/docs/github-action-usage.md b/docs/github-action-usage.md index 0a6731a..0f63dbd 100644 --- a/docs/github-action-usage.md +++ b/docs/github-action-usage.md @@ -15,9 +15,9 @@ after the documented gates have been reviewed. In **Shadow Mode**, PatchGate observes only (`fail-on: never`). It evaluates the PR, writes the `ContributionReceipt`, and can post a Check Run without blocking merge. Pin -[`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4) +[`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5) for this pre-release and pin commit -`d8c67a848a95d456707e6c580a43e4e56e6071a0`. This is not production and not a +the immutable commit SHA shown on that release page. This is not production and not a `v0.1` claim. The Action reads GitHub metadata through the API. Do **not** check out @@ -58,9 +58,9 @@ jobs: # branch-protection snapshots fail closed (correct). A PAT/App token # with administration:read is required for a complete native-control # snapshot. beta.2 posts a Check Run for successful evaluations; - # snapshot-rejection Check Runs are included in beta.4. + # snapshot-rejection Check Runs are included in beta.5. - name: Run PatchGate Shadow Gate - uses: daichunghy/patchgate@d8c67a848a95d456707e6c580a43e4e56e6071a0 + uses: daichunghy/patchgate@v0.1.0-beta.5 with: fail-on: never create-check-run: true @@ -76,7 +76,7 @@ workflow. It is still not production or a `v0.1` claim. ```yaml - name: Run PatchGate Enforcing Gate - uses: daichunghy/patchgate@d8c67a848a95d456707e6c580a43e4e56e6071a0 + uses: daichunghy/patchgate@v0.1.0-beta.5 with: fail-on: blocked create-check-run: true diff --git a/docs/releases/2026-08-23-beta.5.md b/docs/releases/2026-08-23-beta.5.md new file mode 100644 index 0000000..476a02f --- /dev/null +++ b/docs/releases/2026-08-23-beta.5.md @@ -0,0 +1,12 @@ +# PatchGate `v0.1.0-beta.5` + +**Release date:** 23 August 2026 +**Tag:** [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5) + +Beta.5 is the current documentation-synchronized public Action pre-release. +It carries the beta.4 Action behavior and makes the public README, usage guide, +support/security pages, and release record point to one current release tag. + +Pin the immutable commit shown on the release page and keep `fail-on: never`. +This remains shadow-only: it is not a production release, Marketplace listing, +stable `v0.1` claim, or external adoption evidence. diff --git a/docs/releases/beta-release-and-rollback.md b/docs/releases/beta-release-and-rollback.md index a415f22..0125199 100644 --- a/docs/releases/beta-release-and-rollback.md +++ b/docs/releases/beta-release-and-rollback.md @@ -20,7 +20,7 @@ Before publishing a beta, the maintainer must have independently recorded: no-go decision; - support, security-reporting, compatibility and unsupported-behavior wording. -The current repository has public pre-release `v0.1.0-beta.4` and a private +The current repository has public pre-release `v0.1.0-beta.5` and a private development package. The two external shadow installations and production gates remain open.