From e32d7fd618a70bd0d81a0f937f3817a981731f2e Mon Sep 17 00:00:00 2001 From: Hiroshi Shinaoka Date: Mon, 10 Aug 2026 04:03:09 +0900 Subject: [PATCH] rules: add publication and release safety to common repository rules Cross-repository release policy: canonical publication DAG, no versioned forward dev-dependencies, publish-cycle prevention over versioned edges, human-only publication with generated handoff scripts (0700, bash -n, exact-y, TTY guard, restart-safe, checksum-pinned helper), change-aware revalidation lanes, and exact-SHA CI reuse. Reviewed case: tensor4all/tenferro-rs issue #1650 release-workflow hardening (tenferro-specific details stay in its REPOSITORY_RULES.md); sibling repos (Tensor4all.jl, BubbleTeaCI, tidu-rs, chainrules-rs) have no conflicting publication guidance. --- rules/common/repository.md | 43 ++++++++++++++++++++++++++++++++++++++ rules/index.md | 3 ++- 2 files changed, 45 insertions(+), 1 deletion(-) diff --git a/rules/common/repository.md b/rules/common/repository.md index c173c2d..547087f 100644 --- a/rules/common/repository.md +++ b/rules/common/repository.md @@ -28,6 +28,49 @@ - If a needed behavior does not fit the current abstraction, refine the abstraction instead of patching around it locally. +## Publication And Release Safety + +Releasing crates or packages to a registry is irreversible. These rules apply +to every repository that publishes: + +- Maintain a canonical, versioned publication DAG for all publishable + packages, derived from the package dependency graph (topological order over + cross-package normal/build dependencies). A package must publish only after + every package it depends on exists on the registry at the target version. +- A publishable package must not carry a **versioned** dev-dependency on a + package that publishes later in the canonical order: versioned requirements + resolve against the registry during packaging even without verification. + Path-only (unversioned) dev-dependencies are safe for cross-layer tests + because dev-dependencies are stripped from published manifests and never + registry-resolve for consumers; a declared dev version must still match the + workspace version. +- The complete dependency graph among publishable packages must not contain a + publication cycle over versioned edges (versioned edges are the only ones + that registry-resolve at package time; unversioned path dev-edges cannot + create a publish-time cycle). +- Publication is a human-only action. Agents prepare and validate, then stop: + they never execute publication and never type the final confirmation. +- For human execution, generate a guarded handoff script instead of asking + the human to retype commands. The generated script must be mode 0700, + `bash -n` clean, non-append, restart-safe, require a TTY, re-run the + fail-closed preflight, and then ask for one exact lowercase confirmation + immediately before invoking the publish helper with the execute flag. Pin + the helper and canonical workflow with checksums computed at generation and + re-verified at run time, so a later helper change cannot silently alter + publication behavior. Write the script outside the release worktree when + untracked files abort the release. +- Revalidation at release time is change-aware: classify the diff between the + previous release and the tag (helper/workflow-only, publication-metadata + only, semantic manifest, or source/ambiguous) and run only the validation + lane the strongest change demands. Conservative by default: source or + ambiguous changes run the full validation. +- Before skipping a rerun on the strength of previously passed CI, verify + every required check run for the exact release commit (per-repository + canonical query, e.g. GitHub check-runs with `--paginate`), requiring the + run's commit to match, `status == "completed"`, and + `conclusion == "success"`; anything else fails closed and reruns the + applicable tier. + ## Dependency And Boundary Discipline - Shared dependencies should be declared once at the workspace or package diff --git a/rules/index.md b/rules/index.md index ffecd1c..1d29ff3 100644 --- a/rules/index.md +++ b/rules/index.md @@ -6,7 +6,8 @@ load language-specific rules when the task touches that language. ## Common - [`common/repository.md`](common/repository.md): source of truth, API surface, - layering, dependency boundaries, and repository-local overrides. + layering, dependency boundaries, publication/release safety, and + repository-local overrides. - [`common/performance.md`](common/performance.md): general performance review checklist for tensor, compiler, cache, and backend work. - [`common/docs-and-tests.md`](common/docs-and-tests.md): documentation audits,