release: backfill v0.7.0 changelog and release notes#562
Merged
Conversation
…visibility Expand the v0.7.0 entry to reflect the full release: scanner-safe bundle workflow, OIDC contract pack, scanner-safe negative JWK/JWKS and token fixtures, public-surface promise map with compatibility shims, evidence lanes (RIPR, targeted/nightly mutation, perf, release proofs), MSRV bump, and earlier-cycle bug fixes. Add a "Scanner-safe bundles and exports" section and a corresponding lane row to README.md so the headline v0.7.0 feature is discoverable from the top-level docs surface. Add a concrete release-body draft to docs/release/v0.7.0-category-notes.md so `gh release create` has hand-written narrative rather than the auto-generated "Other Changes" fallback caused by unlabeled merged PRs. No source or behavior changes.
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
Summary by CodeRabbit
WalkthroughThis PR updates release documentation for v0.7.0, expanding CHANGELOG entries with narrative, features, and fixes; adding README guidance for scanner-safe bundle workflows and CLI commands; and providing a complete formal release announcement body for publication. Changesv0.7.0 Release Documentation
🎯 1 (Trivial) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
3 tasks
EffortlessSteven
added a commit
that referenced
this pull request
May 11, 2026
Both v0.7.0 publish attempts via `cargo xtask publish` failed: 1. First attempt (tag at #562 merge): `uselesskey-core-seed` packaged before `uselesskey-core` because PUBLISH_CRATES listed compat shims before owner crates. Fixed in #565. 2. Second attempt (tag at #565 merge): `uselesskey-core` packaged but failed because its dev-dep `uselesskey-test-support` (workspace entry has `version = "0.7.0"`) is not in PUBLISH_CRATES at all. Both failures are the same class of bug: a hand-maintained linear PUBLISH_CRATES order that drifts out of sync with cargo metadata when deps move. The user built `shipper` for exactly this — it computes a deterministic DAG from cargo metadata, reconciles against registry truth, retries transient errors, and persists state under `.shipper/` so interrupted runs can resume. Switch both `release.yml` and `publish-retry.yml` to: - `cargo install shipper --locked --version "0.3.0-rc.2"` - `shipper plan` (emit JSON plan into `.shipper/`) - `shipper preflight --policy safe` - `shipper publish --policy safe --readiness-method both --max-attempts 12 --max-delay 15m` - Upload `.shipper/` state as artifacts (plan + final) `publish-retry.yml` adds a `shipper resume --resume-from <crate>` path when `inputs.resume_from` is set, and uses `shipper plan --format text` as the dry-run preview. Token continues to come from `secrets.CARGO_REGISTRY_TOKEN`. OIDC via `crates-io-auth-action` is a separate follow-up. ## Recovery for the in-flight v0.7.0 3 crates are at 0.7.0 on crates.io (`uselesskey-core-hmac-spec`, `uselesskey-jwk`, `uselesskey-core-jwk`); 50 remain at 0.6.0. After this PR merges, dispatch `Publish Retry` on `v0.7.0` with `dry_run: true` to preview, then dispatch again non-dry-run. Shipper reconciles against the registry before any cargo activity, so the 3 already- published crates will be skipped. ## Future work - Adopt `rust-lang/crates-io-auth-action` OIDC token flow. - Drop the hand-maintained `PUBLISH_CRATES` constant in `xtask/src/main.rs` once shipper handles all paths.
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backfill the v0.7.0 changelog, surface the scanner-safe bundle workflow in the README, and add a concrete release-body draft so
gh release createhas hand-written narrative instead of an auto-generatedOther Changesfallback.The v0.7.0 entry that landed in #561 was scoped to the freeze itself. This PR expands it to cover what actually shipped between v0.6.0 and v0.7.0, modeled on the v0.6.0 entry's style.
Changes
[0.7.0] - 2026-05-10:bundle --profile scanner-safe,bundle --profile oidc,verify-bundle,inspect-bundle,export k8s/export vault-kv-json, scanner-safe negative JWK/JWKS and token shapes, thenegative_payload_shapesfacade example, public-surface promise map andcargo xtask public-surfaceguard, release-evidence runner / scanner-safe / OIDC bundle proofs, targeted-mutation lane and nightly mutation, RIPR PR exposure, mutation survivor ledger, scheduled performance evidence workflow and expanded benchmark coverage, Codecov advisory workflow,uselesskey-test-supportfallible-helpers crate, panic-safety policy stack, fixture failure atlas, scanner-safe bundle reference, test-evidence-lanes guide, and v0.7.0 release governance docs.u16::MAXfield encoding, pkcs11-mock label normalization, webhook label JSON escaping, uppercase0Xseed prefix, no-default-featurescore-factorytests,xtask prresilience, BDD matrix isolation, etc).reproducible fixture bundles + handoffrow to Pick The Lane First and a new Scanner-safe bundles and exports section showingbundle/verify-bundle/inspect-bundle/export k8s/export vault-kv-json/bundle --profile oidc. Headline v0.7.0 feature was previously invisible from the README.gh release create. Covers the bundle workflow, OIDC pack, negative payload shapes, public-surface and compatibility shims, evidence lanes, MSRV bump, claim boundary, and evidence links.No source or behavior changes.
Validation
cargo xtask docs-sync --check— passedcargo xtask typos— passedcargo xtask no-blob— passedgit diff --check— clean (no whitespace/conflict markers)target/release-evidence/summary.md).Test plan
gh release create