Skip to content

Record v3.0.0-rc.1 release evidence #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Elodie Mirza (elodiejmirza) merged 1 commit into from
May 4, 2026
Merged

Record v3.0.0-rc.1 release evidence #68

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ telemetry, indexing, and diagnostics.
compatibility tests, examples, benchmark, optional transport adapters, and CLI
inspector.
- Current stable release: `v2.6.0`.
- Release candidate under preparation: `v3.0.0-rc.1`.
- Current release candidate: `v3.0.0-rc.1`.
- `v3.0.0-rc.1` carries the `v2.6.0` evidence-first readiness work into the
next major release line without an intentional public API break.
- Release publication requires clean secure review, local release gates, remote
Expand Down
6 changes: 3 additions & 3 deletions ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
## BLUF

- The next major version target is `v3.0.0`, and `v3.0.0-rc.1` is now the
release-candidate preparation target.
published release candidate.
- `v2.5.0` completed the planned `v2.1.0` through `v2.5.0` additive release
track in one published release.
- `v2.6.0` completed the pre-`v3.0.0` evidence-first readiness track: it stayed
Expand Down Expand Up @@ -44,8 +44,8 @@ last synced on 2026-05-04.
| `v2.4.0`: Production Service Toolkit | Done | Completed in `v2.5.0`; no standalone release |
| `v2.5.0`: Assurance And API Readiness | Done | Released 2026-05-01 |
| `v2.6.0`: Evidence-First Readiness | Done | Released 2026-05-03 |
| `v3.0.0-rc.1`: Major Release Candidate | In progress | Release prep in progress |
| `v3.0.0`: Final Major Release | Todo | Not released |
| `v3.0.0-rc.1`: Major Release Candidate | Done | Released 2026-05-04 as prerelease |
| `v3.0.0`: Final Major Release | In progress | Not released |

Release evidence is recorded in [docs/release.md](docs/release.md).

Expand Down
60 changes: 46 additions & 14 deletions docs/release.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,22 +127,54 @@ scripts/verify-docs.sh
git diff --check
```

## v3.0.0-rc.1 Release Candidate Preparation

- Target tag: `v3.0.0-rc.1`.
- Scope: prepare a no-intentional-break major release candidate after the
`v2.6.0` evidence-first track.
- Required before publication: clean secure review, local release gate, remote
CI, security gate, semver review, regenerated SBOM and SHA-256 evidence,
GitHub Release verification, and downstream smoke against the published RC.
- Downstream smoke manifest versions are prepared for `3.0.0-rc.1`; the
downstream smoke lockfile must be regenerated from crates.io after all RC
crates are published.
## v3.0.0-rc.1 Release Evidence

- Tag: `v3.0.0-rc.1`.
- Commit: `f5612574181ba13254c82cbe3a6dd9667ee95ccf`.
- Scope: publishes a no-intentional-break major release candidate after the
`v2.6.0` evidence-first track, with SBOM/hash supply-chain evidence and RC
prerelease publication guards.
- Release PRs: <https://github.com/SoloSentryOrg/libaprs-engine/pull/66> and
<https://github.com/SoloSentryOrg/libaprs-engine/pull/67>.
- Secure review: clean before PR creation, merge, tagging, and publication; no
open findings. Pre-publication findings were fixed forward before the tag:
downstream smoke lockfile checksums were kept on published `2.6.0` until RC
crates existed, README wording stopped presenting unpublished RC crates as
current stable, and the publish guard now marks RC GitHub Releases as
prerelease without replacing the stable latest release.
- Local pre-publish gate: `scripts/verify-release.sh` passed on release-guard
fix commit `4fb625ce50bbb706cc74531ed981f73a917e87d2`, which had the same
release tree before merge. The earlier RC preparation gate also passed on
`177a43a8f8f9e0da92c6ef927178dee052b42b5b`.
- Remote GitHub Actions: release PR #66 and fix-forward PR #67 passed Rust CI,
docs, merge gate, secret scan, and supply-chain checks. The `main` push for
release commit `f5612574181ba13254c82cbe3a6dd9667ee95ccf` passed Rust CI run
`25337775979`, including the release-script job, plus docs run
`25337776010`, secret-scan run `25337776016`, and supply-chain run
`25337776048`.
- Semver evidence: `cargo semver-checks check-release -p libaprs-engine
--baseline-version 2.6.0 --release-type minor --all-features` passed as
no-break evidence before publication.
- crates.io publication: all workspace crates published as `3.0.0-rc.1` and
verified unyanked through the crates.io API.
- GitHub Release: `v3.0.0-rc.1` created as a prerelease, not latest, at
<https://github.com/SoloSentryOrg/libaprs-engine/releases/tag/v3.0.0-rc.1>.
`v2.6.0` remains the GitHub latest stable release.
- Post-publication downstream smoke and package validation:
`cargo check --manifest-path examples/downstream-smoke/Cargo.toml --locked
--offline` passed against the refreshed crates.io lockfile, and dependent
crate `cargo package` validation passed for all transport crates and
`aprs-cli`. The generated downstream smoke `target` directory was removed
before the locked smoke rerun after Cargo stalled on stale target fingerprint
state; no tracked source or evidence file was removed.
- Migration guide: [v3.0.0 Migration Plan](v3-migration.md).
- Release notes: [libaprs-engine v3.0.0-rc.1](release-notes-v3.0.0-rc.1.md).
- Status: preparation only; do not treat this section as release evidence until
the release commit, tag, crates.io publication, GitHub Release, and
post-publication smoke results are recorded.
- GitHub Project #3: `v3.0.0-rc.1: Major Release Candidate` marked `Done`,
target date set to 2026-05-04, release evidence added to the item, and
`v3.0.0: Final Major Release` moved to `In progress`.
- Notes: the release used the default Cargo home. The benchmark gate was
skipped because this release candidate does not change
parser-performance-sensitive behavior.

## v2.6.0 Release Evidence

Expand Down
56 changes: 28 additions & 28 deletions examples/downstream-smoke/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions scripts/check-v3-rc-evidence.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@ if ! grep -F 'No intentional public API break' docs/v3-migration.md >/dev/null 2
note_failure "v3 migration guide must state the no-intentional-break migration"
fi

if ! grep -F '## v3.0.0-rc.1 Release Candidate Preparation' docs/release.md >/dev/null 2>&1; then
note_failure "docs/release.md is missing v3.0.0-rc.1 preparation evidence"
if ! grep -F '## v3.0.0-rc.1 Release Evidence' docs/release.md >/dev/null 2>&1; then
note_failure "docs/release.md is missing v3.0.0-rc.1 release evidence"
fi

if [ "$failures" -ne 0 ]; then
Expand Down
6 changes: 3 additions & 3 deletions supply-chain/SHA256SUMS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@ dcd586f84aafd9d471fd775f68fa5846dc972a9fb2d9181d04df0e77e0d695f1 crates/aprs-tr
e665d64a55cef1aebd1c30245fc7620efc54e6f379c51af90b15ae117be156c0 crates/aprs-transport-udp/Cargo.toml
c121ff2d5d8f5a57cb8ed88cf959b3d423f75bcc708bcfb8d0de24c9e283ee7b crates/libaprs-engine/Cargo.toml
cd43e1176a5c0a57afba0b1785c3a009b91db4415aba0948aef1000a71522361 deny.toml
448ff340b83e551ce1977fe63687c5114faacdb90ea72c69ce24c50a6cc87a95 docs/release.md
0629cb66ff029f9a0fa1c6785e6bdfaa0514599e9d9f0ef73b550c865924b07e docs/release.md
c2d742ecf1dce587e4d640fecc64b439a1c63180854a4ceab78e04ce8cd20547 docs/supply-chain.md
40644cfe3b0bfd7744afddeee9d80f9efad8f9657dd4d0e1ca668d70989ccf32 examples/downstream-smoke/Cargo.lock
7c887299026c9e9836396554308f3f8af7687767eb6f58dea4b587ca3edd8636 examples/downstream-smoke/Cargo.lock
d95c535c90552cca823b2d7111dca465eb70954a46900fe85887272260523a77 examples/downstream-smoke/Cargo.toml
4535bb052abb176ac7ed9a1cb790de1263a70b1f58cc7dae624d220831beb0cd fuzz/Cargo.lock
df2cf75836de46e4b5030d41dd40767e3096b71a7463cd309fb818cb0a6e85c5 fuzz/Cargo.toml
Expand All @@ -35,7 +35,7 @@ b402cdbf352d96d578ebc1ac03017fe4781558f7e381247e28ef32fb5ba3e556 scripts/check-
aa31f5a3287e4fb96c1c07bff3714c44bc8662f782bae686e635629b635450b8 scripts/check-merge-gate.sh
8dfd311c3efa568f3e5ea4e661f28a12bfeeb01cbfef6c8aef31ac869eb5bacd scripts/check-secrets.sh
c38d6d056a5cf2786bf54c9e2af94ba482f653dd256c658b74b436cf0bf75200 scripts/check-v2-6-evidence.sh
01fe12eefd5be805b9ca9ea2f6fb7045e4b5bf82d498baf7dbc509bc86cbd7d2 scripts/check-v3-rc-evidence.sh
5d5fc5735cddf6504f44a92da27f5fb27b939f88be8b41796da2df4ba52b2137 scripts/check-v3-rc-evidence.sh
ee369d3c1b14cffc00074799318aa899366c459c9ddb095c832694502c5aa649 scripts/check-workflow-optimizations.sh
774777aa1cf3c56934792e39be70528bc993e8fa8ee6568712fff37a1acb19e3 scripts/generate-supply-chain-evidence.sh
54b19306af5262d3dcfeacf43369861fcb738ead97585e74c29aa3b80a5b4af9 scripts/install-release-tools.sh
Expand Down