Skip to content

Add a Claude skill for cutting State Tool releases - #3861

Open
icanhasmath wants to merge 4 commits into
masterfrom
marcg/release-state-tool-skill
Open

icanhasmath wants to merge 4 commits into
masterfrom
marcg/release-state-tool-skill

Conversation

@icanhasmath

@icanhasmath icanhasmath commented Oct 22, 2026 •

Copy link
Copy Markdown
Collaborator

Adds .claude/skills/release-state-tool/SKILL.md, the release procedure as learned while cutting 0.48.2-RC1 (PROD-240). It's separate from the release PRs.

Steps 0–10 were all done for real on the 0.48.2 beta (#3863, #3865, #3866, #3864, then staging, signing, promote and verify, 2026-10-23 to 10-26). Two things haven't been run with it yet: the merge back into master and the stable (beta → release) path.

What it records:

  • The base: continue the last release's version branch (version/0-48-1-RC4 + version.txt bump = version/0-48-2-RC1) and cherry-pick the master changes that ship. Don't merge master, which has drifted, and don't branch from beta.
  • What ships: master's first-parent commits since the last Merge branch 'version/...', not beta..master.
  • version/* is protected: direct pushes and "Update branch" are refused, so every change goes in as a PR.
  • Syncing with beta: a PR that merges beta in, merged with a merge commit, so the release PR isn't BEHIND. The release PR itself is squash-merged, so each release repeats this.
  • CI failures from 0.48.2 and their fixes: the check-format bug on an empty diff, the Scan/Trivy CVE gate (it blocks Deploy) and how to bump Go and dependencies for it, the keypair test flake after the Go bump, the macOS sysinfo timing flake and the Windows internal/hail TestOpen flake.
  • Staging: what Deploy stages, and that the served version drops -RCn (0.48.2-SHA89954c6).
  • Windows signing: the TI team signs the four exes in the update zip (PROD-1352). How to check the returned zip, then put it in place and update the sha256 in both Windows info.json files, since the updater checks it. Remove TI's sign/ folder before promoting.
  • Promote: run it from a clean beta checkout after generating the constants (otherwise it fails with undefined: constants.ChannelName). It moves everything under staging/.
  • Verify: query the update service for every platform, check the production Windows zip's hash and signatures, and run the downloaded Linux binary.
  • Local checks (constants generation, -vet=off, running Trivy locally) and CI tooling quirks.

Records the release flow (master after the last beta merge-back ->
release branch -> beta -> release), the changelog convention, and the
post-merge staging, Windows signing, S3 promotion and merge-back steps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@icanhasmath icanhasmath mentioned this pull request Oct 22, 2026
icanhasmath and others added 3 commits October 23, 2026 12:54
Releases continue the last RC branch with cherry-picks from master; they
are not cut from master or beta. Records the protected version branches,
the beta sync merge, the CI failures hit on 0.48.2 and their fixes, the
Trivy scan gate, CI tooling quirks, and the S3 checks. Steps after the
beta merge are marked unverified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From 0.48.2-RC2: cutting a fix-up RC from beta's tip, re-signing it, testing
encrypted private ingredients with a key contract, CVEs that keep arriving
during a release, and the macOS socket-path failure on long branch names.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant