Skip to content

feat: prepare fable-session 0.3.0b1 public beta #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
askclaw-vesper merged 2 commits into from
Jul 14, 2026
Merged

feat: prepare fable-session 0.3.0b1 public beta #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1b1a62c
feat: 0.3.0b1 public-beta release candidate
askclaw-vesper Jul 14, 2026
fed5404
Harden 0.3.0b1 prerelease: least-privilege CI, fail-closed tag gate, …
askclaw-vesper Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 47 additions & 13 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,44 +1,78 @@
# CI for fable-session. Deliberately owner/URL-free: the workflow only uses
# marketplace actions by name and never references a repository URL.
# Fetching build tooling (setup-python, pip, PyYAML) is allowed; the tests
# themselves are deterministic and offline.
# marketplace actions by name and never references a repository URL. All
# actions are pinned to verified tag SHAs. Fetching build tooling
# (setup-python, pip, PyYAML, build, the offline-smoke wheelhouse seed) is
# allowed in dedicated preparation steps; the tests themselves are
# deterministic and offline, and the offline install smoke never touches an
# index during its install phase.
name: ci

on:
push:
pull_request:

# Least-privilege workflow permissions — CI only ever reads the
# repository. No job widens this; nothing in CI writes contents,
# packages, or attestations.
permissions:
contents: read

jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
# checkout v4 (pinned tag SHA). fetch-depth 0: the full-history
# readiness scan must see every reachable commit, not a shallow tip.
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
fetch-depth: 0

- uses: actions/setup-python@v5
# setup-python v5 (pinned tag SHA).
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: "3.12"

- name: Compile all sources
run: python3 -m compileall -q src tests

- name: Install test dependency (PyYAML, workflow validation only)
run: python3 -m pip install --quiet PyYAML
- name: Install test dependency (PyYAML, workflow validation only; pinned tested version)
run: python3 -m pip install --quiet PyYAML==6.0.2

- name: Run the full unit test suite
run: python3 -m unittest discover -s tests -v

- name: Public-readiness scan of the tracked tree
run: python3 tests/public_readiness_check.py

- name: Install and smoke the CLI
- name: Public-readiness scan of the FULL history
run: python3 tests/full_history_readiness_check.py

- name: Whitespace hygiene (git diff --check against the empty tree)
run: git diff --check "$(git hash-object -t tree /dev/null)" HEAD

- name: Pre-seed the offline-smoke wheelhouse (network allowed HERE only)
run: |
mkdir -p /tmp/fable-wheelhouse
python3 -m pip download --quiet --dest /tmp/fable-wheelhouse --no-deps "setuptools==83.0.0"

- name: Offline install smoke (no index during the install phase)
run: FABLE_SESSION_WHEELHOUSE=/tmp/fable-wheelhouse python3 tests/offline_install_smoke.py

# Pinned, tested build toolchain (the seed above satisfies the
# pyproject `setuptools>=77` floor); --no-isolation keeps the build
# on exactly these versions instead of a floating isolated env.
- name: Build the wheel and sdist (pinned toolchain)
run: |
python3 -m pip install --quiet build==1.5.1 setuptools==83.0.0 wheel==0.47.0
python3 -m build --no-isolation

- name: Install the built wheel and smoke the CLI
run: |
python3 -m pip install --quiet .
python3 -m pip install --quiet dist/*.whl
fable-session --version
fable-session --version | grep -F "0.3.0b1"

@adaptcom adaptcom Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The expected version '0.3.0b1' is hardcoded here (and twice in tests/offline_install_smoke.py), so every release bump requires touching CI and the smoke in lockstep or the pipeline goes red on an otherwise-correct bump. Consider deriving the expected version from pyproject.toml (e.g. python3 -c "import tomllib; ...") so the single source of truth is the file release_tag_check.py already gates on. Separately, 'on: push + pull_request' double-runs CI for PR branches pushed to this repo; restricting push to main (or tags) would halve CI noise without losing coverage.

fable-session --help
fable-session run --help
fable-session audit --help
fable-session watch --help
claude-context-run --help > /dev/null
claude-context-audit-models --help > /dev/null
claude-session-watchdog --help > /dev/null
python3 -c "from importlib.metadata import distribution; eps = distribution('fable-session').entry_points; assert not any(ep.name == 'fs' for ep in eps), 'fs must never ship'"
python3 -c "from importlib.metadata import distribution; eps = distribution('fable-session').entry_points; banned = {'fs', 'claude-context-run', 'claude-context-audit-models', 'claude-session-watchdog'}; assert not any(ep.name in banned for ep in eps), 'removed/forbidden console names must never ship'"
104 changes: 104 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
# Tag-triggered PRERELEASE workflow for fable-session (e.g. tag
# v0.3.0-beta.1 for distribution version 0.3.0b1). Deliberately
# owner/URL-free and pinned to verified tag SHAs.
#
# What it does: re-run the local release gates on the exact tagged commit,
# build the wheel and sdist, generate SHA256SUMS, attest build provenance
# with GitHub artifact attestation (no maintainer key material exists, and
# none is invented), and create a GitHub PRERELEASE carrying the artifacts.
#
# Out of scope by decision: any package-index publication — that is a
# later, explicit step, not part of this prerelease.
name: prerelease

on:
push:
tags:
- "v*"

permissions:
contents: write
id-token: write
attestations: write

jobs:
prerelease:
runs-on: ubuntu-latest
steps:
# checkout v4 (pinned tag SHA); full depth for the history scan.
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
fetch-depth: 0

# setup-python v5 (pinned tag SHA).
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: "3.12"

# Fail-closed consistency gate BEFORE anything else: the checked-out
# package version admits exactly one release tag (0.3.0b1 only from
# v0.3.0-beta.1); any other tag name, or an unmapped version shape,
# refuses the whole run.
- name: Tag / package-version consistency gate (fail closed)
run: python3 tests/release_tag_check.py --tag "${GITHUB_REF_NAME}"

- name: Release gates on the exact tagged commit
run: |
python3 -m compileall -q src tests
python3 -m pip install --quiet PyYAML==6.0.2
python3 -m unittest discover -s tests -v
python3 tests/public_readiness_check.py
python3 tests/full_history_readiness_check.py
git diff --check "$(git hash-object -t tree /dev/null)" HEAD

- name: Pre-seed the offline-smoke wheelhouse (network allowed HERE only)
run: |
mkdir -p /tmp/fable-wheelhouse
python3 -m pip download --quiet --dest /tmp/fable-wheelhouse --no-deps "setuptools==83.0.0"

- name: Offline install smoke (no index during the install phase)
run: FABLE_SESSION_WHEELHOUSE=/tmp/fable-wheelhouse python3 tests/offline_install_smoke.py

# Pinned, tested build toolchain (the seed above satisfies the
# pyproject `setuptools>=77` floor); --no-isolation keeps the build
# on exactly these versions instead of a floating isolated env.
- name: Build the wheel and sdist (pinned toolchain)
run: |
python3 -m pip install --quiet build==1.5.1 setuptools==83.0.0 wheel==0.47.0
python3 -m build --no-isolation

- name: Smoke the built wheel
run: |
python3 -m pip install --quiet dist/*.whl
fable-session --version

- name: Generate SHA256SUMS
run: |
cd dist
sha256sum * > SHA256SUMS
cat SHA256SUMS

# upload-artifact v4 (pinned tag SHA): CI-side copy of the artifacts.
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: dist
path: dist/

# attest-build-provenance v3 (pinned tag SHA): GitHub artifact
# attestation instead of a maintainer key that does not exist.
- uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 # v3
with:
subject-path: |
dist/*.whl
dist/*.tar.gz

# softprops/action-gh-release v2 (pinned tag SHA): always a
# PRERELEASE — flipping a release to "latest" is a separate human
# decision, never automated here.
- uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
with:
prerelease: true
files: |
dist/*.whl
dist/*.tar.gz
dist/SHA256SUMS
100 changes: 61 additions & 39 deletions PUBLIC_RELEASE_CHECKLIST.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,54 +1,76 @@
# Public release checklist

**Status: public release is BLOCKED.** Every unchecked item below is an
independent blocker. Do not push any history, publish a package, or make
the repository public until all of them are resolved and re-verified.
independent blocker. Do not publish a package or flip the repository
public until all of them are resolved and re-verified.

## Blockers
## Resolved

- [x] **License: RESOLVED — MIT.** `LICENSE` contains the standard MIT
license text (`Copyright (c) 2026 AskClaw contributors`) and
`pyproject.toml` metadata says MIT. The old placeholder wording must
never come back; `tests/public_readiness_check.py` fails the tree if
it does.
- [ ] **Old git history still contains removed internal references.** The
0.2.0 tree is scrubbed, but earlier commits retain internal paths,
hostnames, and project names that were removed from the current
tree. The existing history must therefore **never be pushed
publicly** as-is. History was intentionally not rewritten in place.
- [ ] **Final clean-history export/review is not complete.** Before any
push to the official repository, produce a fresh export (e.g. an
orphan/squashed initial commit of the reviewed tree, or an audited
filtered history), run the full-history reference scan against the
export until it reports zero hits, and have the export
**independently reviewed**. Nothing has been exported, reviewed, or
pushed yet.
`pyproject.toml` metadata carries the SPDX expression `MIT` with
`license-files = ["LICENSE"]`. The old placeholder wording must
never come back; `tests/public_readiness_check.py` fails the tree
if it does.
- [x] **Owner and URLs: RESOLVED.** The official repository location is
`https://github.com/getaskclaw/fable-session`; `pyproject.toml`
carries the homepage/repository/issues URLs. The CI workflow stays
deliberately URL-free.
- [x] **Official repository: RESOLVED — exists, private, reserved.** The
official private repository exists at
`https://github.com/getaskclaw/fable-session` and is reserved for
the independently reviewed clean-history root; this checkout
deliberately configures no remote pointing at it. Its existence
unblocks nothing below — the export/review and visibility blockers
stand on their own, and only the reviewed clean-history export may
ever be pushed to it.
- [ ] **Repository visibility: still private — must stay private.** The
repository must not be made public (and no package may be
published) until every other item in this checklist is resolved and
re-verified. Flipping visibility is the deliberate final step.

## Pre-publication verification (after the blockers are cleared)
carries the homepage/repository/issues URLs. The CI and release
workflows stay deliberately URL-free.
- [x] **Clean-history export and independent review: RESOLVED.** The
official private repository now holds exactly one independently
reviewed clean root commit (`4ead2832…`, the reviewed 0.2.0 tree,
produced as an orphan export). The full-history reference scan
reports zero hits on that history, and this checkout's `origin`
remote is a read-only local bundle of that same reviewed root —
release work builds on top of it, never beside it.

## Standing warning — the OLD history

The ORIGINAL pre-export working history (the private development
repository this project was extracted from) still contains removed
internal paths, hostnames, and project names. That history must
**never be pushed** publicly, mirrored, or attached to the official
repository. Only the reviewed clean root commit and commits reviewed on top
of it may ever be published; `tests/full_history_readiness_check.py`
verifies exactly that property on the history that is actually being
published.

## Remaining blockers

- [ ] **Repository visibility: still private — flipping public is the
deliberate final step.** While the repository is private, finish
all remaining code, history, and test work (the 0.3.0b1 release
candidate included) and re-run every verification below on the
exact release commit. Only after everything passes is the
repository made public.
- [ ] **Enable and verify private vulnerability reporting — immediately
AFTER the repository becomes public.** GitHub private vulnerability
reporting is a setting for public repositories, so it cannot be
switched on while the repository is private and no step may claim
otherwise. The moment the repository goes public, enable the
setting and verify that the "Report a vulnerability" button appears
under the repository's Security tab, so `SECURITY.md`'s reporting
path is actually usable from the first public minute.

## Pre-publication verification (on the exact release commit)

- [ ] `python3 -m compileall -q src tests` passes.
- [ ] `python3 -m unittest discover -s tests` passes.
- [ ] `python3 tests/public_readiness_check.py` exits 0 on the exact tree
being published.
- [ ] Full-history internal-reference scan of the exact history being
published reports zero hits.
- [ ] `python3 tests/full_history_readiness_check.py` exits 0 on the
exact history being published (every tracked blob of every commit
reachable from the release commit).
- [ ] `python3 tests/offline_install_smoke.py` passes.
- [ ] GitHub private vulnerability reporting is verified enabled on the
official repository, so `SECURITY.md`'s reporting path is actually
usable.
- [ ] `python3 -m build` produces the `0.3.0b1` wheel and sdist; the
wheel installs into a fresh environment and answers
`fable-session --version`.
- [ ] `git diff --check "$(git hash-object -t tree /dev/null)" HEAD`
reports no whitespace errors.
- [ ] The prerelease tag name is `v0.3.0-beta.1` (distribution version
`0.3.0b1`); `release.yml` enforces this fail-closed via
`tests/release_tag_check.py` (only the canonical tag for the
checked-out package version may release), re-runs these
gates, builds the artifacts, generates `SHA256SUMS`, attests build
provenance, and creates a GitHub prerelease. Package-index
publication stays out of scope for this prerelease.
Loading
Loading