Repository navigation
Conversation
potiuk
added
family:tools
potiuk
added this pull request to stack #1620
October 13, 2026 14:14
… results as code
release-verify-rc ran the release-verify checks and then had the agent
turn the configuration into their arguments and classify what came
back, by hand, from ~10k tokens of prose. tools/release-management now
does it, reading saved files only (no network, no gpg, nothing run):
- `args` emits the exact release-verify invocations for Steps 1-3, 5-8
and `all` from release-build.md: --expect / --expect-optional per
artefact, the digest set (never md5), --prohibit / --accept,
validators, the manifest and the unpacked directory.
- `rat` (Step 4): exit code and report → PASS / FAIL with the
unapproved files, or SKIP + WARN when no RAT config exists.
- `source-tree` (Step 7): REVIEW resolved from validator exit codes.
- `jvm` (Step 6b): the gate, jvm_digest_set, --podling from a root
DISCLAIMER, ABSENT → FAIL only under `staged`, findings and the
per-companion `gpg --verify` line.
- `nexus` (Step 6c): the gates, the staging-repo id shape
(`orgapache<project>-NNNN` or `snapshots`, checked before any URL is
built, because the id is spliced into curl URLs), the read-only
recipe, and every classification rule over the saved probe output.
- `repro` (Step 9): mandatory / skip, the RM-key vs ci-automated source
table, SWHIDs compared without qualifiers, per-mode binary rules,
`binaries.differs`.
- `report` (Step 10): the report and --post-to comment from
`release-verify verdict`, with the voter-obligation reminder and the
trusted-hardware attestation only when every condition holds.
The trusted-hardware attestation fails closed: it needs automated
signing, Step 9 PASS, the source identical and every declared
convenience artefact positively `identical` (one that was skipped or
never rebuilt withholds it too), and --trusted-hardware. Every rendered
recipe quotes its configured values with the shared shell helpers.
release-config's `load --skill verify-rc` now exposes the
required/optional artefact marker, binary-exclude globs, RAT paths,
validators and JVM keys the arguments need (existing fields unchanged).
SKILL.md becomes a router (9,936 → 6,280 tokens, 684 → 466 lines): the
36 failure-mode rows move into per-step files, and the JVM, Nexus and
reproducibility siblings keep their policy plus the command to run.
Step numbering ("Step 9"), the "Reproducibility validated on trusted
hardware" literal and `binaries.differs`, which release-promote reads,
are unchanged, and a test pins the reminder and attestation literals.
Evals: 33 cases in 9 suites → 17 in 8. The step-9 suite and the
scripted 6b / 6c cases become pytest cases named after each former
case; the judgement cases stay, their fixtures now carrying the real
tool output.
Generated-by: Claude Opus 5
Claude-Session: https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 13, 2026 15:23
a7d855d to
1fa7801
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| from dataclasses import dataclass, field | ||
| from typing import Any | ||
|
|
||
| from release_management.shell import dq as dq # re-exported for the step modules |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Second PR of the release-management stack; it builds on #1604.
release-verify-rcran therelease-verifychecks, then had the agent work out their arguments fromrelease-build.mdand classify what came back, by hand.tools/release-management verify-rcnow does it, reading saved files only.args(the exactrelease-verifyinvocations),rat(Step 4),source-tree(Step 7 REVIEW resolution),jvm(6b gates and findings),nexus(6c gates, staging-repo id check, every classification rule over saved probe output),repro(Step 9) andreport(Step 10 report and--post-tocomment).load --skill verify-rcnow exposes the required/optional artefact marker, binary-exclude globs, RAT paths, validators and JVM keys. Existing fields are unchanged.Security notes
^orgapache[a-z0-9]+-[0-9]+$orsnapshots. The recipes stay GETs only.identical(an artefact that was skipped or never rebuilt also withholds it), and--trusted-hardware.binaries.differs, and the Step 9 numbering. A test pins the reminder and attestation literals against both skills.Behaviour I checked against the normative text
tools/asf-nexus/staging-verification.mdand the classification rules; only the one-line summary innexus-staging.mdreads looser.jvm_companion_locationunset: this behaves as before (notstaged), so an ABSENT jar is not a FAIL.Type of change
Test plan
prek run --all-filespasses on the stack tip.tools/release-management: pytest / ruff / mypy, including a real-loadintegration test.tools/release-confighas 4 new load tests.step-6c case-3failed there, and that case's fixture now carries the realnexusoutput, including the existence-200 line and.sha1siblings its "otherwise complete" scenario describes.Was generative AI tooling used to co-author this PR?
Generated-by:.🤖 Generated with Claude Code
https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv