diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c59d7b9..b6f01c3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -233,14 +233,17 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - ref: ${{ github.event.pull_request.head.sha || github.sha }} + ref: refs/tags/v1.0.0-rc.1 - uses: ./.github/actions/setup-php-composer with: php-version: "8.4" - - name: Verify the exact committed artifact + - name: Verify the immutable RC artifact env: - ARTIFACT_SHA: ${{ github.event.pull_request.head.sha || github.sha }} - run: composer release:verify -- --target=1.0.0-rc.1 --sha="$ARTIFACT_SHA" + ARTIFACT_SHA: 34c3b874525d36ae064c162cdd553bc75d18772b + run: | + set -euo pipefail + test "$(git rev-parse HEAD)" = "$ARTIFACT_SHA" + composer release:verify -- --target=1.0.0-rc.1 --sha="$ARTIFACT_SHA" exploratory: name: Exploratory MySQL Innovation (not required) diff --git a/CHANGELOG.md b/CHANGELOG.md index 29dc2f3..a153282 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,9 +4,9 @@ All notable changes to this project are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/). -## [1.0.0-rc.1] +## [1.0.0-rc.1] - 2026-11-12 -First release candidate target. Publication state recorded during preparation: **Unpublished**. +First release candidate, published on [Packagist](https://packagist.org/packages/maatify/php-persistence). ### Added @@ -20,3 +20,5 @@ First release candidate target. Publication state recorded during preparation: * - Composer manifest, PHPStan at level `max`, PER-CS 3.1 code-style verification, and a real MySQL/MariaDB Integration test infrastructure (`scripts/integration.php`, `compose.integration.yaml`, `docker/integration-matrix.json`). No database version range is declared as supported; see [PHP_PERSISTENCE_PACKAGE_REFERENCE.md ยง8](PHP_PERSISTENCE_PACKAGE_REFERENCE.md#8-database-engine-support). Durable decisions governing the changes above are indexed in [docs/decisions/DECISIONS_INDEX.md](docs/decisions/DECISIONS_INDEX.md). + +[1.0.0-rc.1]: https://github.com/Maatify-ltd/php-persistence/releases/tag/v1.0.0-rc.1 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 900c1ce..3ab830b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -38,7 +38,7 @@ composer test:regression # no Docker needed composer test:integration # needs Docker; starts a disposable MySQL/MariaDB service composer examples:smoke # needs Docker; smoke-executes examples/ against a real engine composer test:consumer # needs Docker; two fresh external Composer verification runs -composer release:verify -- --target=1.0.0-rc.1 --sha="$(git rev-parse HEAD)" +composer release:verify -- --target=1.0.0-rc.1 --sha=34c3b874525d36ae064c162cdd553bc75d18772b actionlint .github/workflows/*.yml ``` diff --git a/README.md b/README.md index a6f962f..74c9420 100644 --- a/README.md +++ b/README.md @@ -8,11 +8,15 @@ Maatify.dev -[![Status at preparation](https://img.shields.io/badge/Status%20at%20preparation-Development-blue)](README.md#overview) +[![Status](https://img.shields.io/badge/Status-Release%20Candidate-blue)](https://github.com/Maatify-ltd/php-persistence/releases/tag/v1.0.0-rc.1) +[![Version](https://img.shields.io/badge/Version-1.0.0--rc.1-blue)](https://packagist.org/packages/maatify/php-persistence) [![PHP](https://img.shields.io/badge/PHP-%5E8.4-8892BF)](composer.json) [![License](https://img.shields.io/badge/License-Proprietary-green)](LICENSE) [![PHPStan](https://img.shields.io/badge/PHPStan-Level%20Max-brightgreen)](README.md#quality-status) +[![Registry](https://img.shields.io/badge/Registry-Packagist-F28D1A)](https://packagist.org/packages/maatify/php-persistence) +[![Monthly downloads](https://img.shields.io/packagist/dm/maatify/php-persistence)](https://packagist.org/packages/maatify/php-persistence/stats) +[![Total downloads](https://img.shields.io/packagist/dt/maatify/php-persistence)](https://packagist.org/packages/maatify/php-persistence/stats) [![Maatify Ecosystem](https://img.shields.io/badge/Maatify-Ecosystem-blueviolet)](https://github.com/Maatify) [![Usage Guide](https://img.shields.io/badge/Docs-Usage_Guide-blue)](docs/guides/USAGE_GUIDE.md) @@ -32,7 +36,7 @@ Direct-PDO Transaction, Pagination, and Ordering utilities for MySQL and MariaDB `maatify/php-persistence` is a small, direct-PDO toolkit with three independent capabilities over a **caller-supplied** `PDO` connection: running callbacks inside a transaction or a caller's savepoint (with optional bounded deadlock replay), parameterized whitelist-sorted bounded pagination, and locking next-position/move operations for integer display-order columns. It is developed as a separate package from the earlier, published `maatify/persistence` ([coexistence rules](docs/decisions/DEC-005-coexistence-with-legacy-package.md)), not a drop-in replacement. -This tree is prepared as the **Release Candidate artifact `1.0.0-rc.1`**. Its **publication state at qualification** is **Unpublished**. +**Release Candidate `1.0.0-rc.1`** is published on [Packagist](https://packagist.org/packages/maatify/php-persistence) and available as a [GitHub pre-release](https://github.com/Maatify-ltd/php-persistence/releases/tag/v1.0.0-rc.1). The package has no Stable release. ## Key Features @@ -53,13 +57,13 @@ These are declared runtime requirements, not a statement that any specific datab ## Installation -The exact Composer installation target for this artifact is: +Install the exact release candidate from Packagist: ```bash composer require maatify/php-persistence:1.0.0-rc.1 ``` -This command resolves through the approved Composer distribution source only after that exact version is published. See the [target changelog](CHANGELOG.md#100-rc1) and [security policy](SECURITY.md) for lifecycle and support details. +See the [changelog](CHANGELOG.md) and [security policy](SECURITY.md) for release and support details. ## Usage diff --git a/docs/guides/RELEASE_ARTIFACT_VERIFICATION.md b/docs/guides/RELEASE_ARTIFACT_VERIFICATION.md index 3cf3167..782e2ee 100644 --- a/docs/guides/RELEASE_ARTIFACT_VERIFICATION.md +++ b/docs/guides/RELEASE_ARTIFACT_VERIFICATION.md @@ -1,16 +1,16 @@ # Release Artifact Verification -The preparation target for this tree is `maatify/php-persistence:1.0.0-rc.1`. Its publication state during preparation is Unpublished. +The release target covered here is `maatify/php-persistence:1.0.0-rc.1`. Its immutable artifact is available at `v1.0.0-rc.1`. Run the same archive checks as CI from a checkout containing the exact committed candidate. The command needs Git, tar, PHP and Composer. ```sh -composer release:verify -- --target=1.0.0-rc.1 --sha="$(git rev-parse HEAD)" +composer release:verify -- --target=1.0.0-rc.1 --sha=34c3b874525d36ae064c162cdd553bc75d18772b ``` The verifier creates an isolated checkout of the selected commit. It generates a VCS archive with `git archive` and a Composer archive with `composer archive`, independently of each other. The verification checks the actual entries and bytes, including required consumer files, the full runtime source, manifest identity and production PSR-4 mapping, and repository-only or sensitive paths. The log records the target, commit, tree, and a file inventory and SHA-256 for each generated archive. The temporary workspace is removed when verification ends. The sensitive-path and private-key checks are structural. The Lead reviews release claims, changelog allocation and the contents for sensitive data in context. -In pull-request CI the archive job checks out and verifies the exact PR HEAD. On a push it verifies the exact pushed commit. Qualification requires Full Applicable CI and Release Artifact Verification on the same actual, Owner-authorized `main` commit and exact target. The [Consumer Verification Harness](CONSUMER_VERIFICATION.md) separately exercises runtime consumption. +Before publication, the archive job verified the exact PR HEAD or pushed SHA. The published RC archive job now checks out the tag and verifies it against its recorded qualified SHA. Other jobs continue to verify the changes on the PR or pushed commit. Qualification of a future target requires Full Applicable CI and Release Artifact Verification on the same actual, Owner-authorized `main` candidate commit for that target. The [Consumer Verification Harness](CONSUMER_VERIFICATION.md) separately exercises runtime consumption. ## Published Artifact Verification diff --git a/tests/Regression/IntegrationInfrastructureTest.php b/tests/Regression/IntegrationInfrastructureTest.php index 6e2fede..5efc820 100644 --- a/tests/Regression/IntegrationInfrastructureTest.php +++ b/tests/Regression/IntegrationInfrastructureTest.php @@ -257,13 +257,14 @@ public function testGateInspectsEveryRequiredJob(): void self::assertStringContainsString('echo "$RESULTS" | jq -e \'all(.[]; .result == "success")\' > /dev/null', $gate); } - public function testReleaseArtifactGateVerifiesTheExactWorkflowSha(): void + public function testReleaseArtifactGateVerifiesTheQualifiedRcTag(): void { $workflow = self::read('.github/workflows/ci.yml'); [, $following] = array_pad(explode("\n release-artifact:\n", $workflow, 2), 2, ''); [$job] = explode("\n exploratory:\n", $following, 2); - self::assertStringContainsString('ref: ${{ github.event.pull_request.head.sha || github.sha }}', $job); - self::assertStringContainsString('ARTIFACT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}', $job); + self::assertStringContainsString('ref: refs/tags/v1.0.0-rc.1', $job); + self::assertStringContainsString('ARTIFACT_SHA: 34c3b874525d36ae064c162cdd553bc75d18772b', $job); + self::assertStringContainsString('test "$(git rev-parse HEAD)" = "$ARTIFACT_SHA"', $job); self::assertStringContainsString('composer release:verify -- --target=1.0.0-rc.1 --sha="$ARTIFACT_SHA"', $job); self::assertStringContainsString('persist-credentials: false', $job); self::assertStringContainsString('"release:verify": "@php scripts/release-artifact.php"', self::read('composer.json'));