From 8c3e8a0e7965af1bd21d5d6bea686d6b5b913992 Mon Sep 17 00:00:00 2001 From: Ayinkx <199975741+Ayinkx@users.noreply.github.com> Date: Wed, 28 Oct 2026 14:41:45 +0100 Subject: [PATCH] release: add tag-driven binaries and prepare v0.1.0 Add a Release workflow that builds Linux x86_64, macOS arm64, and Windows x86_64 archives on v*.*.* tags, attaches SHA256 checksums, and creates the GitHub Release. Update the changelog and release-status documentation for v0.1.0. --- .github/workflows/release.yml | 104 ++++++++++++++++++++++++++++++++ CHANGELOG.md | 10 +-- README.md | 16 +++-- docs/APPEAL.md | 11 ++-- docs/ARCHITECTURE.md | 3 +- docs/BUILD_REPORT.md | 10 ++- docs/DRIPS_APPLICATION_DRAFT.md | 10 +-- docs/DRIPS_READINESS.md | 4 +- docs/FINAL_AUDIT.md | 5 +- docs/PROJECT_STATUS.md | 16 +++-- docs/RELEASE_CHECKLIST.md | 3 +- docs/WHY_DEVKIT.md | 3 +- 12 files changed, 163 insertions(+), 32 deletions(-) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..fe83397 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,104 @@ +name: Release + +on: + push: + tags: ["v*.*.*"] + +permissions: + contents: write + +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: false + +jobs: + create-release: + name: Create release + runs-on: ubuntu-latest + steps: + - name: Create or reuse GitHub Release + env: + GH_TOKEN: ${{ github.token }} + TAG: ${{ github.ref_name }} + run: | + set -euo pipefail + if gh release view "$TAG" >/dev/null 2>&1; then + echo "Release $TAG already exists." + else + gh release create "$TAG" --title "$TAG" --generate-notes + fi + + build: + name: Build (${{ matrix.target }}) + needs: create-release + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + include: + - os: ubuntu-latest + target: x86_64-unknown-linux-gnu + archive: tar.gz + - os: macos-latest + target: aarch64-apple-darwin + archive: tar.gz + - os: windows-latest + target: x86_64-pc-windows-msvc + archive: zip + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable + with: + toolchain: stable + targets: ${{ matrix.target }} + - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2 + with: + workspaces: "." + - name: Build release binary + run: cargo build --release --locked -p devkit-cli --target ${{ matrix.target }} + + - name: Package archive (Unix) + if: matrix.archive == 'tar.gz' + shell: bash + run: | + set -euo pipefail + TAG="${GITHUB_REF_NAME}" + NAME="stellar-foundry-${TAG}-${{ matrix.target }}" + mkdir -p "dist/${NAME}" + cp "target/${{ matrix.target }}/release/stellar-foundry" "dist/${NAME}/" + cp README.md LICENSE "dist/${NAME}/" + tar -C dist -czf "dist/${NAME}.tar.gz" "${NAME}" + if command -v sha256sum >/dev/null 2>&1; then + (cd dist && sha256sum "${NAME}.tar.gz" > "${NAME}.tar.gz.sha256") + else + (cd dist && shasum -a 256 "${NAME}.tar.gz" > "${NAME}.tar.gz.sha256") + fi + + - name: Package archive (Windows) + if: matrix.archive == 'zip' + shell: pwsh + run: | + $tag = $env:GITHUB_REF_NAME + $name = "stellar-foundry-$tag-${{ matrix.target }}" + New-Item -ItemType Directory -Force -Path "dist/$name" | Out-Null + Copy-Item "target/${{ matrix.target }}/release/stellar-foundry.exe" "dist/$name/" + Copy-Item README.md, LICENSE "dist/$name/" + Compress-Archive -Path "dist/$name" -DestinationPath "dist/$name.zip" + $hash = (Get-FileHash "dist/$name.zip" -Algorithm SHA256).Hash.ToLower() + "$hash $name.zip" | Out-File -Encoding ascii "dist/$name.zip.sha256" + + - name: Upload archive (Unix) + if: matrix.archive == 'tar.gz' + shell: bash + env: + GH_TOKEN: ${{ github.token }} + TAG: ${{ github.ref_name }} + run: gh release upload "$TAG" dist/*.tar.gz dist/*.tar.gz.sha256 --clobber + + - name: Upload archive (Windows) + if: matrix.archive == 'zip' + shell: pwsh + env: + GH_TOKEN: ${{ github.token }} + TAG: ${{ github.ref_name }} + run: gh release upload $env:TAG dist/*.zip dist/*.zip.sha256 --clobber diff --git a/CHANGELOG.md b/CHANGELOG.md index b5c505f..bc7e492 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,10 +5,11 @@ All notable changes to this project are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [Unreleased] +## [0.1.0] - 2026-10-28 -The workspace version is `0.1.0`. This section describes merged work on `main`; -no tagged release or crates.io publication exists yet. +First tagged release. Prebuilt binaries for Linux x86_64, macOS arm64, and +Windows x86_64 are attached to the GitHub Release with SHA256 checksums. +crates.io publication is still pending. ### Added @@ -55,7 +56,8 @@ no tagged release or crates.io publication exists yet. ### Limitations -- No tagged release, release binaries, or crates.io publication exists yet. +- crates.io publication is still pending; install from the GitHub Release or + build from source. - `contractspecv0` XDR entries are decoded into official XDR-JSON definitions with a variant kind and best-effort name; a normalized ABI schema remains future work. diff --git a/README.md b/README.md index 65ac88f..668be93 100644 --- a/README.md +++ b/README.md @@ -9,10 +9,12 @@ and a CLI. The core works fully **offline** and never requires AI. -> Status: early, pre-release (`0.1.0` in the workspace). The implementation -> described below is merged on `main`. No tagged release or crates.io -> publication exists yet. See [docs/PROJECT_STATUS.md](docs/PROJECT_STATUS.md) -> for exactly what works today. Only documented features exist. +> Status: early, `0.1.0`. The implementation described below is merged on +> `main`, and `v0.1.0` has prebuilt Linux, macOS, and Windows binaries on the +> [Releases page](https://github.com/StellarFoundry/stellar-devkit/releases). +> crates.io publication is still pending. See +> [docs/PROJECT_STATUS.md](docs/PROJECT_STATUS.md) for exactly what works +> today. Only documented features exist. ## What works today @@ -37,6 +39,10 @@ exact scope and known limitations. ## Install and build +Download a prebuilt binary from the +[Releases page](https://github.com/StellarFoundry/stellar-devkit/releases), or +build from source: + ```bash cargo build --release ./target/release/stellar-foundry version @@ -74,7 +80,7 @@ Decode commands accept `-` to read one bounded value from stdin. Exit codes: code-scanning permissions. - RPC configuration is currently consumed by `rpc-health`; other commands do not make network requests. -- No tagged release, release binaries, or crates.io publication exists yet. +- crates.io publication is still pending; binaries are on the Releases page. ## Relationship to other Stellar tooling diff --git a/docs/APPEAL.md b/docs/APPEAL.md index 4713bf2..063f037 100644 --- a/docs/APPEAL.md +++ b/docs/APPEAL.md @@ -47,8 +47,11 @@ link to a merged PR, commit, CI run, release, or contributor. > 4. **The scope is distinct.** DevKit is an XDR/RPC/transaction/contract > inspection workflow. It is not a source-level vulnerability scanner; the > boundary with `soroban-security-scanner` is documented in `docs/WHY_DEVKIT.md`. +> 5. **There is a release.** `v0.1.0` is published with Linux, macOS, and Windows +> binaries plus SHA256 checksums. > > Evidence: +> - Release: https://github.com/StellarFoundry/stellar-devkit/releases/tag/v0.1.0 > - Merge: `aec759c` > - CI: https://github.com/StellarFoundry/stellar-devkit/actions/runs/40690141880 > - RustSec: https://github.com/StellarFoundry/stellar-devkit/actions/runs/40690141721 @@ -87,10 +90,10 @@ it first. Example: These are not required, but they strengthen an appeal: -- Tag and publish `v0.1.0` with release binaries and checksums. -- Publish the workspace crates to crates.io. -- Get 3–5 external contributions or documented real-world usage. -- Add a docs site or a recorded end-to-end demo with real testnet data. +- [x] Tag and publish `v0.1.0` with release binaries and checksums. +- [ ] Publish the workspace crates to crates.io. +- [ ] Get 3–5 independent external contributions or documented real-world usage. +- [ ] Add a docs site or a recorded end-to-end demo with real testnet data. ## After submitting diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index ac18881..bfef842 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -146,7 +146,8 @@ Commands: `version`, `doctor`, `strkey`, `scval`, `envelope`, `event`, - Rule/CLI exit codes and machine output are treated as API and documented. - The toolkit tracks current Stellar protocol crates (28.x line at the time of writing). -- The workspace version is `0.1.0`; no tagged release exists yet. +- The workspace version is `0.1.0`; `v0.1.0` is tagged and released. crates.io + publication is still pending. ## Testing architecture diff --git a/docs/BUILD_REPORT.md b/docs/BUILD_REPORT.md index a32bb85..aaeae68 100644 --- a/docs/BUILD_REPORT.md +++ b/docs/BUILD_REPORT.md @@ -68,7 +68,12 @@ read or logged. ## Release status -No releases yet. No tagged release, binaries, or crates.io publication. +`v0.1.0` is tagged and published with Linux x86_64, macOS arm64, and Windows +x86_64 archives plus SHA256 checksums: + + + +crates.io publication is still pending. ## Issue backlog @@ -89,7 +94,8 @@ See [DRIPS_READINESS.md](DRIPS_READINESS.md), ## Known limitations -- No tagged release, release binaries, or crates.io publication. +- crates.io publication is still pending; use the GitHub Release or build from + source. - `contractspecv0` output is XDR-JSON with best-effort names, not a normalized ABI. - Analysis rules are structural heuristics, not a vulnerability proof. diff --git a/docs/DRIPS_APPLICATION_DRAFT.md b/docs/DRIPS_APPLICATION_DRAFT.md index c955a02..6894fce 100644 --- a/docs/DRIPS_APPLICATION_DRAFT.md +++ b/docs/DRIPS_APPLICATION_DRAFT.md @@ -13,8 +13,8 @@ typed RPC protocol layer with deterministic mocks and a bounded HTTP transport; non-executing WASM inspection; deterministic structural findings with SARIF 2.1.0 output; strict TOML configuration; and a CLI named `stellar-foundry`. -The implementation is merged into `main`. There is no tagged release or crates.io -publication yet. +The implementation is merged into `main`. `v0.1.0` is released with prebuilt +Linux, macOS, and Windows binaries; crates.io publication is still pending. ## Problem and ecosystem relevance @@ -89,8 +89,10 @@ available. artifact exists and code-scanning permissions are available. - RPC configuration is wired into `rpc-health`; other commands do not consume RPC settings. -- No tagged release, release binaries, or crates.io publication exists yet. -- External adoption is limited; no external contributor has merged a PR yet. +- crates.io publication is still pending; install from the GitHub Release or + build from source. +- External adoption is limited; no independent external contributor has merged a + PR yet. ## Supporting documentation diff --git a/docs/DRIPS_READINESS.md b/docs/DRIPS_READINESS.md index aa03a2f..594bf7f 100644 --- a/docs/DRIPS_READINESS.md +++ b/docs/DRIPS_READINESS.md @@ -73,8 +73,8 @@ exact scope. WASM artifact in the repository plus code-scanning permissions. - RPC config is wired into `rpc-health`; other commands do not use RPC settings. Endpoint precedence is command line, then environment, then config file. -- The workspace is `0.1.0`, but there is no tagged release, no release binaries, - and no crates.io publication. +- `v0.1.0` is released with Linux, macOS, and Windows binaries and checksums; + crates.io publication is still pending. - The project has limited external adoption: no external contributors have merged PRs yet, and the repository is new. Do not present issue counts or labels as evidence of traction. diff --git a/docs/FINAL_AUDIT.md b/docs/FINAL_AUDIT.md index f0c6d1a..4f7924c 100644 --- a/docs/FINAL_AUDIT.md +++ b/docs/FINAL_AUDIT.md @@ -26,8 +26,9 @@ Audit date: 2026-10-28. Commit: `aec759c`. | Fuzzing | Verified | `fuzz/fuzz_targets/*`; scheduled fuzz workflow | | Performance measured | Partial | Memory measurement example; benchmarks pending | | Composite GitHub Action | Pending | Tracked as an issue; only manual SARIF upload exists | -| Release binaries / crates.io | Pending | No tag, no binaries, no crates.io package | -| External contributors | Pending | No external contributor has merged a PR yet | +| Tagged release + binaries | Verified | `v0.1.0` with Linux/macOS/Windows archives and SHA256 checksums | +| crates.io publication | Pending | No crates.io package yet | +| External contributors | Pending | No independent external contributor has merged a PR yet | ## Notes diff --git a/docs/PROJECT_STATUS.md b/docs/PROJECT_STATUS.md index e73f88a..b69f82c 100644 --- a/docs/PROJECT_STATUS.md +++ b/docs/PROJECT_STATUS.md @@ -1,6 +1,6 @@ # Project Status -**Current phase:** Developer-tooling implementation merged on `main`; pre-release hardening +**Current phase:** Developer-tooling implementation merged on `main`; post-`v0.1.0` hardening **Repository:** https://github.com/StellarFoundry/stellar-devkit @@ -48,9 +48,13 @@ Rust 1.91.0 MSRV tests: ## Release status -The workspace version is `0.1.0`. There is **no tagged release**, no GitHub -Release with binaries, and no crates.io publication yet. The release-validation -workflow and checklist exist, but publishing remains outstanding work. +The workspace version is `0.1.0`, and `v0.1.0` is tagged and published with +prebuilt Linux x86_64, macOS arm64, and Windows x86_64 binaries plus SHA256 +checksums: + +- https://github.com/StellarFoundry/stellar-devkit/releases/tag/v0.1.0 + +crates.io publication remains outstanding. ## Remaining limitations @@ -64,8 +68,8 @@ workflow and checklist exist, but publishing remains outstanding work. - RPC configuration is wired into `rpc-health`: command-line endpoint overrides environment, which overrides the TOML file. Other commands do not consume RPC configuration because they do not make network requests. -- The project is pre-release. Do not describe the workspace version as a - published release. +- crates.io publication is pending. Do not describe the workspace as published + on crates.io. ## Security status diff --git a/docs/RELEASE_CHECKLIST.md b/docs/RELEASE_CHECKLIST.md index c0e54f0..3ce1b79 100644 --- a/docs/RELEASE_CHECKLIST.md +++ b/docs/RELEASE_CHECKLIST.md @@ -10,4 +10,5 @@ Before publishing a version: 6. Confirm the lockfile is regenerated and committed after dependency changes. 7. Review the generated SARIF against the SARIF 2.1.0 schema. 8. Verify artifacts and checksums before publishing; do not include credentials or local configuration. -9. State known limitations in the release notes. Structural analysis findings are heuristics and do not prove a vulnerability. +9. Push the `v*.*.*` tag and confirm the `Release` workflow uploaded the Linux, macOS, and Windows archives plus SHA256 checksums. +10. State known limitations in the release notes. Structural analysis findings are heuristics and do not prove a vulnerability. diff --git a/docs/WHY_DEVKIT.md b/docs/WHY_DEVKIT.md index 24c4e4c..1a00e2a 100644 --- a/docs/WHY_DEVKIT.md +++ b/docs/WHY_DEVKIT.md @@ -80,7 +80,8 @@ belong to XDR/RPC/transaction inspection belong here. ABI. - Structural analysis is heuristic, not a vulnerability proof. - RPC configuration currently applies to `rpc-health`. -- No tagged release or crates.io publication exists yet. +- `v0.1.0` is released with Linux, macOS, and Windows binaries; crates.io + publication is still pending. If a workflow needs something not listed here, treat it as planned work only when an open issue says so.