mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-23 20:25:56 +00:00
Cut 6.5 and later releases from main
Releases are cut from the head of main since 2 October, but three things still made every release need hand edits before it could pass: - the control plane routed 6.5.x to the abandoned release/v6.5 line; - main lacked the published 6.4.4 to 6.4.6 packets, so rollback derivation on main still found 6.4.1; - the packet tests pinned prose from old 6.4.x notes (named highlights, issue numbers, one release's mobile decision) and the per-release sentences in the deployment-installability contract, which changes several times a day on main. Map 6.5 to main, carry the published packets over from release/v6.4, and keep the packet tests to what the release tooling generates: version pins, packet pointers, required sections and the rollback, signing and mobile sentences. Contract-Neutral: Release routing and release-packet test scope only; no runtime, install or public contract changes.
This commit is contained in:
rcourtman
@@ -1221,20 +1221,6 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"),
|
||||
`CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`,
|
||||
)
|
||||
installabilityPath := repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md")
|
||||
installabilityRequired := make([]string, 0, 3)
|
||||
installabilityRequired = append(installabilityRequired,
|
||||
"The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
if rcDerived {
|
||||
installabilityRequired = append(installabilityRequired, "promoted_from_tag="+promotedTag)
|
||||
} else {
|
||||
installabilityRequired = append(installabilityRequired,
|
||||
"This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.",
|
||||
)
|
||||
}
|
||||
assertFileContainsAllNormalized(t, installabilityPath, installabilityRequired...)
|
||||
}
|
||||
|
||||
func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
@@ -1258,11 +1244,6 @@ func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"`v"+version+"` is a stable minor release",
|
||||
"stable `v"+previous+"`",
|
||||
"## What's improved",
|
||||
"Alerts that survive restarts",
|
||||
"More control over notifications",
|
||||
"Earlier resource warnings",
|
||||
"More accurate Proxmox and PBS coverage",
|
||||
"Pulse Mobile iOS build 12 and Android versionCode 9 remain compatible",
|
||||
"not Authenticode-signed",
|
||||
"Unknown Publisher warning",
|
||||
"The rollback target is stable `v"+previous+"`",
|
||||
@@ -1271,8 +1252,8 @@ func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"Version: `v"+version+"`",
|
||||
"Previous stable: `v"+previous+"`",
|
||||
"Rollback target: `v"+previous+"`",
|
||||
"Promotion path: owner-approved expedited exact-SHA stable cutoff from `main`",
|
||||
"Mobile decision: `existing-mobile-build-compatible`",
|
||||
"Promotion path: ",
|
||||
"Mobile decision: ",
|
||||
"standing SignPath-unavailable policy applies",
|
||||
)
|
||||
assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"),
|
||||
@@ -1300,15 +1281,6 @@ func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"),
|
||||
`CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`,
|
||||
)
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"`rollback_version=v"+previous+"`",
|
||||
"The integrated single-build workflow must pass its exact-SHA preflight and immutable readiness gates before publication.",
|
||||
"The stable server cut is classified `existing-mobile-build-compatible`.",
|
||||
"explicit version-bound owner decision",
|
||||
"standing unavailable policy",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
}
|
||||
|
||||
func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
@@ -1320,8 +1292,7 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
if !ok {
|
||||
t.Skip("current prerelease does not have a previous stable patch")
|
||||
}
|
||||
stableTarget, _, ok := strings.Cut(version, "-")
|
||||
if !ok {
|
||||
if _, _, ok := strings.Cut(version, "-"); !ok {
|
||||
t.Fatalf("current prerelease %q has no stable target", version)
|
||||
}
|
||||
comparisonVersion, ok := previousPrereleaseVersion(version)
|
||||
@@ -1336,13 +1307,6 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"# Pulse v"+version+" Release Notes",
|
||||
"## What's improved",
|
||||
"## Before you upgrade",
|
||||
"Same-name systems stay separate",
|
||||
"Windows agent delivery is restored",
|
||||
"Large Availability estates scan faster",
|
||||
"Slow starts are recoverable",
|
||||
"Disk I/O totals are more accurate",
|
||||
"carries every change from the `v6.4.2` packet",
|
||||
"map at least one trusted IdP group to the built-in `admin` role",
|
||||
"not Authenticode-signed",
|
||||
"Unknown Publisher warning",
|
||||
"does not require a companion mobile release",
|
||||
@@ -1357,17 +1321,10 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"Version: `v"+version+"`",
|
||||
"Previous stable: `v"+previous+"`",
|
||||
"Rollback target: `v"+previous+"`",
|
||||
"Promotion path: exact-SHA single-build release candidate from `main`",
|
||||
"Promotion path: ",
|
||||
comparisonSummary,
|
||||
"carries the complete `v6.4.2` change set",
|
||||
"no longer pin a guest in Backup Running",
|
||||
"(#1815)",
|
||||
"no longer collapse into a single host or Docker record",
|
||||
"(#1753)",
|
||||
"Windows Unified Agent auto-update no longer fails with HTTP 404",
|
||||
"(#1820)",
|
||||
"Windows signing decision: prereleases publish checksum- and detached-signature-verified Windows agents without Authenticode",
|
||||
"Mobile decision: `no-mobile-impact`",
|
||||
"Mobile decision: ",
|
||||
"no companion mobile build or store rollout is required",
|
||||
)
|
||||
if version == "6.3.0-rc.6" {
|
||||
@@ -1419,14 +1376,6 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"),
|
||||
`CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`,
|
||||
)
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"This prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"For the active prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
"No governed mobile-facing path changed from `v"+previous+"`, so the release decision is `no-mobile-impact`",
|
||||
"no companion upload or public mobile-store rollout is part of this candidate.",
|
||||
"The prerelease Windows path retains exact-SHA, checksum, and detached-signature verification without Authenticode. Stable `v"+stableTarget+"` also skips SignPath under the standing unavailable policy",
|
||||
)
|
||||
}
|
||||
|
||||
func TestBackfillReleaseWorkflowRepairsPublishedAssetsWithoutRebuilds(t *testing.T) {
|
||||
|
||||
@@ -414,58 +414,6 @@ func TestInstallDockerScriptFallbackPinsCurrentVersion(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestInstallDockerProofTracksStablePatchReleaseContract(t *testing.T) {
|
||||
version := currentReleaseVersion(t)
|
||||
if isPrereleaseVersion(version) {
|
||||
t.Skip("current release is a prerelease")
|
||||
}
|
||||
previous, ok := previousStablePatchVersion(version)
|
||||
if !ok {
|
||||
t.Skip("current release is not a stable patch release")
|
||||
}
|
||||
promotedTag, rcDerived := currentStablePatchPromotedPrerelease(t, version)
|
||||
installabilityPath := repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md")
|
||||
|
||||
required := make([]string, 0, 5)
|
||||
required = append(required,
|
||||
"The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"`no-mobile-impact`",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
if rcDerived {
|
||||
// An RC-derived stable patch promotes the exercised same-version
|
||||
// candidate, so the active-stable paragraph names the promoted tag
|
||||
// instead of the emergency no-RC hotfix path.
|
||||
required = append(required, "promoted_from_tag="+promotedTag)
|
||||
} else {
|
||||
required = append(required,
|
||||
"This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.",
|
||||
"active customer harm",
|
||||
)
|
||||
}
|
||||
assertFileContainsAllNormalized(t, installabilityPath, required...)
|
||||
|
||||
if version == "6.3.1" {
|
||||
assertFileContainsAllNormalized(t, installabilityPath,
|
||||
"the prior `v"+previous+"` decision could not be reused for this patch",
|
||||
"the release owner recorded that separate `v6.3.1` exception",
|
||||
"public Unknown Publisher disclosure",
|
||||
)
|
||||
} else if !rcDerived {
|
||||
assertFileContainsAllNormalized(t, installabilityPath,
|
||||
"standing SignPath-unavailable policy from `v6.3.2` onward",
|
||||
"Public Unknown Publisher disclosure",
|
||||
)
|
||||
}
|
||||
if version == "6.4.2" {
|
||||
assertFileContainsAllNormalized(t, installabilityPath,
|
||||
"The governed branch is `main`",
|
||||
"authenticated non-administrator organization members can reach infrastructure action control",
|
||||
"SSO-only deployments can treat every authenticated IdP user as an instance administrator without an explicit grant",
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInstallDockerProofTracksStableMinorContract(t *testing.T) {
|
||||
version := currentReleaseVersion(t)
|
||||
if isPrereleaseVersion(version) {
|
||||
@@ -475,8 +423,7 @@ func TestInstallDockerProofTracksStableMinorContract(t *testing.T) {
|
||||
if !valid || parts[1] == 0 || parts[2] != 0 {
|
||||
t.Skip("current release is not a stable minor release")
|
||||
}
|
||||
previous, ok := previousStableForPrereleaseVersion(version + "-rc.1")
|
||||
if !ok {
|
||||
if _, ok := previousStableForPrereleaseVersion(version + "-rc.1"); !ok {
|
||||
t.Fatal("stable minor release has no earlier stable rollback packet")
|
||||
}
|
||||
|
||||
@@ -486,57 +433,6 @@ func TestInstallDockerProofTracksStableMinorContract(t *testing.T) {
|
||||
assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"),
|
||||
`CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`,
|
||||
)
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"`rollback_version=v"+previous+"`",
|
||||
"`hotfix_exception=true` transports that approved waiver through the shared promotion resolver. It does not reclassify v"+version+" as a patch hotfix.",
|
||||
"The integrated single-build workflow must pass its exact-SHA preflight and immutable readiness gates before publication.",
|
||||
"The stable server cut is classified `existing-mobile-build-compatible`.",
|
||||
"Stable `v"+version+"` skips SignPath under the standing unavailable policy and retains exact-SHA, checksum, detached-signature, immutable-manifest, published-digest, and Unknown Publisher disclosure controls.",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
}
|
||||
|
||||
func TestInstallDockerProofTracksPrereleaseContract(t *testing.T) {
|
||||
version := currentReleaseVersion(t)
|
||||
if !isPrereleaseVersion(version) {
|
||||
t.Skip("current release is stable")
|
||||
}
|
||||
previous, ok := previousStableForPrereleaseVersion(version)
|
||||
if !ok {
|
||||
t.Skip("current prerelease does not have a previous stable patch")
|
||||
}
|
||||
stableTarget, _, ok := strings.Cut(version, "-")
|
||||
if !ok {
|
||||
t.Fatalf("current prerelease %q has no stable target", version)
|
||||
}
|
||||
comparisonVersion, ok := previousPrereleaseVersion(version)
|
||||
comparisonLine := "It follows stable `v" + previous + "` and opens the published `v" + stableTarget + "` candidate line."
|
||||
if !ok {
|
||||
comparisonVersion = previous
|
||||
} else {
|
||||
comparisonLine = "It follows `v" + comparisonVersion + "` on the published `v" + stableTarget + "` candidate line."
|
||||
}
|
||||
if version == "6.4.0-rc.10" {
|
||||
comparisonLine = "The `v6.4.0-rc.9` release staged an immutable draft, tag, and exact-version artifacts but did not activate publicly"
|
||||
}
|
||||
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
comparisonLine,
|
||||
"This prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"No governed mobile-facing path changed from `v"+previous+"`, so the release decision is `no-mobile-impact`",
|
||||
"no companion upload or public mobile-store rollout is part of this candidate.",
|
||||
"The prerelease Windows path retains exact-SHA, checksum, and detached-signature verification without Authenticode. Stable `v"+stableTarget+"` also skips SignPath under the standing unavailable policy",
|
||||
"For the active prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
)
|
||||
if version == "6.3.0-rc.6" {
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"For `v6.3.0-rc.6`, the release path retains credential-free PVE compilation while requiring the measured memory floor for API race shards after a bounded admission wait.",
|
||||
"Public server and provider control-plane image publication uses independent matrix jobs that each revalidate the exact checkout and candidate manifest.",
|
||||
"Private packaging transfers only the products consumed by Pro assembly, and paid-runtime Docker and direct-binary mismatch proofs execute concurrently without weakening either proof.",
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func runInstallDockerScript(t *testing.T, workDir string, envVars ...string) {
|
||||
|
||||
@@ -252,11 +252,12 @@ class ControlPlaneAuditTest(unittest.TestCase):
|
||||
"v6.4.6-rc.1", "6.4.6", "v6.4.6+build.1"):
|
||||
with self.subTest(version=version):
|
||||
self.assertEqual(release_branch_for_version(version), "release/v6.4")
|
||||
# Every release from 6.5.0 on is cut from main (founder direction,
|
||||
# 2 October 2026), so later versions need no release-line entry.
|
||||
for version in ("6.4.1", "6.4.2", "6.4.7-rc.1", "6.4.60-rc.1", "6.4.50-beta.1", "6.4.40-beta.1",
|
||||
"6.4.30", "6.3.20", "6.6.0-beta.1"):
|
||||
"6.4.30", "6.3.20", "6.5.0-rc.1", "6.5.0", "6.5.10-beta.1", "6.6.0-beta.1"):
|
||||
with self.subTest(version=version):
|
||||
self.assertEqual(release_branch_for_version(version), "main")
|
||||
self.assertEqual(release_branch_for_version("6.5.10-beta.1"), "release/v6.5")
|
||||
|
||||
def test_forward_patch_workflow_branch_contract(self) -> None:
|
||||
# Execute the real branch-policy shell only, never dispatch a workflow.
|
||||
|
||||
Reference in New Issue
Block a user