release: dorian v1.0.2 announcement hotfix#14
Merged
Conversation
Public-facing coherence + edge-case fixes on top of 1.0.1. No breaking changes
(warrant format, checker grammar, exit codes, trust semantics unchanged).
Resolves the post-1.0.1 use-and-see validation findings (Codex HOTFIX_BEFORE_ANNOUNCE).
Bug fixes (regression-tested):
- export: an artifact literally named *.warrant now exports its own
foo.warrant.warrant sidecar instead of mis-stripping the suffix (FINDING-05).
- suggest-claims: parse file bytes so PEP 263 encoding cookies are honored;
valid non-UTF8 Python is accepted, unknown codec is a clear usage error (FINDING-06).
- symbol_index: guard git ls-files in pyproject_script_definers so a non-git
checkout with precomputed definers + [project.scripts] degrades to {} (keeps
the documented "non-git yields {}" contract) instead of raising GitError.
Workflow / security:
- security.yml: pip-audit now audits the resolved PROJECT dependency set
(uv export --all-extras --dev --no-emit-project | pip-audit -r), not the
isolated pip-audit tool env, with a scope-assert step (FINDING-03).
- all actions/checkout steps set persist-credentials: false; none do
authenticated git ops (release/publish use OIDC, not git creds) (FINDING-04).
- release-gate test job sets enable-cache: false for a clean-resolve build.
Docs / guards / version:
- README + action docs: dorian/action@main -> @v1.0.2; drop the stale
"until the PyPI release" source-install override (FINDING-01, FINDING-02).
- ATTESTATION_INTEROP example dorianVersion is version-neutral (FINDING-07).
- in-toto determinism test asserts both CLI calls succeed (FINDING-08).
- version-sync guard catches "until the PyPI release", dorian/action@main in
public snippets, and a hardcoded dorianVersion (FINDING-09 + 02 + 07).
- bump 1.0.1 -> 1.0.2; BENCHMARK_CURRENT re-stamped (both suites re-run at
1.0.2 reproduce exactly; binding-lifecycle run_id 168b50d9aa631d52).
- new: docs/releases/v1.0.2.md, docs/ANNOUNCEMENT_READINESS.md.
Gates: 874 tracked tests green (+5 new), ruff clean, bandit clean,
project-scope pip-audit clean, wheel/sdist + twine check pass; the documented
encode/httpx real catch independently reproduced on this build.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…e-judge catch) The independent v1.0.2 release judge found README.md still advertised the PyPI Trusted-Publisher 'latest: v1.0.0' on a coherence-focused release — the one README line naming a released PyPI version, contradicting FINDING-01's thesis. The existing version-sync guard only scanned pre-PyPI phrases + the rc2 literal, so it slipped past CI. - README: 'latest: v1.0.0' -> 'v1.0.2'. - test_version_sync: new guard asserts the README 'latest: vX.Y.Z' PyPI string equals the package version (red against v1.0.0, green at v1.0.2), so this drift class is caught in future bumps. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (22)
📝 WalkthroughWalkthroughVersion bump from 1.0.1 to 1.0.2 with three source bug fixes ( Changesdorian v1.0.2 Release
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Announcement-readiness hotfix on top of v1.0.1. No breaking changes — the warrant format, checker grammar, exit codes, and trust semantics are unchanged. The point is public-facing coherence (one version across PyPI, README, Action docs, and the GitHub release) plus two edge-case bug fixes, a real SCA-scope fix, and CI credential hardening.
Resolves the post-1.0.1 use-and-see validation findings (Codex GPT-5.5
HOTFIX_BEFORE_ANNOUNCE).Findings closed
pip install dorian-vwpmatches the documented command surfacedorian/action@main→@v1.0.2(README + action docs); guard addedsecurity.ymlpip-audit now audits the project dep set (export +-r), with a scope-assert steppersist-credentials: falseon every checkout (none do authenticated git ops)exportof an artifact literally named*.warrantno longer mis-strips the suffixsuggest-claimsparses file bytes → PEP 263 encoding cookies honoreddorianVersionexample is version-neutral; guardedaction@main, hardcodeddorianVersionsymbol_index.pyproject_script_definersguardsgit ls-files(non-git + precomputed definers no longer raises)Test / gate evidence
.warrant, PEP 263, unsupported-codec, two non-git symbol_index cases).twine checkpass.run_id168b50d9aa631d52) → the hotfix touches no checker numeric behavior.encode/httpxreal catch independently reproduced on this build: verify exit 0 → revalidate exit 4 →REVOKED,httpx-python-floor-38BROKEN (1 selective candidate).Honest scope
One documented, reproduced real cross-PR catch on frozen public SHAs — not broad real-world validation.
--deny-exec/checker_trust: baseare fail-closed controls, not sandboxes.suggest-claimschecks existence/value, not behavior. The in-toto export is experimental, not a registered predicate.PyPI plan
After merge: tag
v1.0.2, GitHub Release, release-gate on the tag, then publish to PyPI via thepublish.ymlTrusted-Publisher (OIDC) workflow →pip install dorian-vwp== 1.0.2.🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes – v1.0.2
Bug Fixes
.warrantDocumentation
Chores