From 4191258a7a42c6b449045309256772eb4b1f35cb Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Sat, 15 Aug 2026 07:55:35 +0530 Subject: [PATCH 1/2] release: record v2.0.0 GA asset and cutover state --- README.md | 18 ++++++++---------- docs/consumer-validation-status.md | 30 ++++++++++++++---------------- docs/first-party-cutover.md | 19 ++++++++++--------- first-party-cutover.yaml | 10 +++++----- 4 files changed, 37 insertions(+), 40 deletions(-) diff --git a/README.md b/README.md index c470fc0..3a3f44b 100644 --- a/README.md +++ b/README.md @@ -6,12 +6,11 @@ | Version | License | Install | Release notes | | --- | --- | --- | --- | -| `2.0.0` | [Apache-2.0](LICENSE) | `brew install basefoundry/base/base-bash-libs` | [v2.0.0 (planned)](https://github.com/basefoundry/base-bash-libs/issues/215) | +| `2.0.0` | [Apache-2.0](LICENSE) | `brew install basefoundry/base/base-bash-libs` | [v2.0.0](https://github.com/basefoundry/base-bash-libs/releases/tag/v2.0.0) | -The v2.0.0 row describes the planned next stable release. The v2.0.0-rc.1 -candidate was verified against the same release contract before GA publication. -Until its canonical GA asset is published and the first-party cutover is -complete, v1.4.0 remains the current stable package. +The v2.0.0 release is published with a deterministic bundle archive, checksum +manifest, SPDX SBOM, and provenance statement. First-party consumer and +Homebrew pins are being promoted to the exact GA commit as part of issue #240. Reusable Bash standard library for reliable shell scripts. @@ -226,11 +225,10 @@ The repo-root `VERSION` file is the source of truth for the package version. The top strip in this README and the runtime `BASE_BASH_LIBS_VERSION` constant are validated against that file. -`v1.4.0` remains stable during the clean-break v2 release preparation. The -sole next stable target is `v2.0.0`; there will be no stable v1.5.0 or version -reset to 0.x. See the [versioning and release-line policy](docs/versioning-policy.md) -for prerelease identifiers, the withdrawn July 2026 v2 event, immutable -consumption, and the post-GA support contract. +`v2.0.0` is the current stable release. It is intentionally a clean break from +the v1 surface; SemVer compatibility guarantees apply from v2.0.0 onward. See +the [versioning and release-line policy](docs/versioning-policy.md) for +immutable consumption and the post-GA support contract. Pinned checkout, archive, Homebrew, vendored, and standalone consumption is documented in [`docs/pinned-consumption.md`](docs/pinned-consumption.md). diff --git a/docs/consumer-validation-status.md b/docs/consumer-validation-status.md index 28dd40a..a6fd92b 100644 --- a/docs/consumer-validation-status.md +++ b/docs/consumer-validation-status.md @@ -10,22 +10,22 @@ has approved publication. ## Framework reference -The validation below used the immutable `base-bash-libs` v2.0.0-rc.1 -candidate at commit -`c134fb8a3397e2cfee1d90845cec44f56dacae7b`. The annotated tag -[v2.0.0-rc.1](https://github.com/basefoundry/base-bash-libs/releases/tag/v2.0.0-rc.1) -and its canonical archive, SHA256SUMS, SPDX SBOM, and provenance assets were -downloaded and verified. This is RC evidence, not a GA support claim. +The release gate used the immutable `base-bash-libs` v2.0.0 GA at merge commit +`b4243765726c133499feeabdc50154f99c0fec12`. The +[v2.0.0 release](https://github.com/basefoundry/base-bash-libs/releases/tag/v2.0.0) +archive, SHA256SUMS, SPDX SBOM, and provenance assets were downloaded and +verified. The canonical archive SHA256 is +`73d6f92fab8f1a8ded7f3b4312ebbe51aa8ec0c16eacf18c2d8fa23fb5664333`. ## Consumer matrix | Checkout | Relationship | Reference | Deployment exercised | Result | Classification | | --- | --- | --- | --- | --- | --- | -| Base | First-party direct consumer | merged [6038cba](https://github.com/basefoundry/base/commit/6038cbaf93eb21ccb26c17a612aded85deedb04b) | CI pinned to `c134fb8` (v2.0.0-rc.1) | PR [#1934](https://github.com/basefoundry/base/pull/1934): Python/pylint, integration, security, BATS, Ubuntu source-checkout, macOS smoke, and branch policy all passed | Pass; useful readiness evidence, not independent adoption evidence | -| Base Demo | First-party representative consumer | merged [b54bf00](https://github.com/basefoundry/base-demo/commit/b54bf008a9dfb542c5c51dc919c3e10698a2f5eb) | CI pinned to `c134fb8` (v2.0.0-rc.1) | PR [#214](https://github.com/basefoundry/base-demo/pull/214): validation, Ubuntu, source-checkout, and branch policy all passed; local full validation passed with isolated caches | Pass; useful readiness evidence, not independent adoption evidence | +| Base | First-party direct consumer | merged [6038cba](https://github.com/basefoundry/base/commit/6038cbaf93eb21ccb26c17a612aded85deedb04b) | CI currently pinned to `c134fb8` (v2.0.0-rc.1); GA pin PR pending | PR [#1934](https://github.com/basefoundry/base/pull/1934): Python/pylint, integration, security, BATS, Ubuntu source-checkout, macOS smoke, and branch policy all passed | RC pass; GA promotion pending | +| Base Demo | First-party representative consumer | merged [b54bf00](https://github.com/basefoundry/base-demo/commit/b54bf008a9dfb542c5c51dc919c3e10698a2f5eb) | CI currently pinned to `c134fb8` (v2.0.0-rc.1); GA pin PR pending | PR [#214](https://github.com/basefoundry/base-demo/pull/214): validation, Ubuntu, source-checkout, and branch policy all passed; local full validation passed with isolated caches | RC pass; GA promotion pending | | BankBuddy | Adjacent repository; no direct `base-bash-libs` reference | `e32561c` | None | Repository validation: **312 passed** | Excluded from the consumer count | | BanyanLabs | Adjacent repository; no direct `base-bash-libs` reference | `15ef6cd` | None | Repository baseline present | Excluded from the consumer count | -| Homebrew | First-party package-manager consumer | stable tap remains `v1.4.0` | Disposable RC tap using canonical `v2.0.0-rc.1` archive | `brew audit --new`, source build, formula smoke test, and stable restore all passed; stable tap was not changed | Pass for RC rehearsal; GA formula PR remains pending | +| Homebrew | First-party package-manager consumer | stable tap remains `v1.4.0` | Disposable RC tap passed; GA formula PR pending | RC audit, source build, formula smoke test, and stable restore all passed | RC pass; GA promotion pending | The Base and Base Demo checkouts are controlled by the primary author. They are valuable first-party regression signals, but they do not satisfy the @@ -40,11 +40,10 @@ No independent production consumer has yet supplied a reproducible run covering installed, vendored, and bundled deployments together. The local vendor and reference-application rollback suites pass, and the -Homebrew RC-to-v1.4 restore was rehearsed. A true RC-to-GA upgrade still -cannot be validated until the immutable `v2.0.0` GA asset exists. That -remaining release prerequisite is tracked by -[#240](https://github.com/basefoundry/base-bash-libs/issues/240) and -[#215](https://github.com/basefoundry/base-bash-libs/issues/215). +Homebrew RC-to-v1.4 restore was rehearsed. A true RC-to-GA upgrade is now +reproducible against the immutable v2.0.0 asset; downstream pin and formula +promotion remains tracked by +[#240](https://github.com/basefoundry/base-bash-libs/issues/240). ## Findings and limitations @@ -52,8 +51,7 @@ remaining release prerequisite is tracked by API or behavior finding. - The v2 release archive is a deterministic bundle, not the v1 full-source archive. The GA Homebrew formula must therefore install the bundle layout - and use the `base_` API in its smoke test; the v1.4 formula remains - intentionally unchanged until that GA handoff. + and use the `base_` API in its smoke test. - Base Demo local full validation passed with isolated Go and Gradle caches; the hosted Ubuntu and source-checkout jobs passed as well. - There are no permissioned public users or case studies yet, so diff --git a/docs/first-party-cutover.md b/docs/first-party-cutover.md index 540baf3..d508ed0 100644 --- a/docs/first-party-cutover.md +++ b/docs/first-party-cutover.md @@ -1,8 +1,8 @@ # First-party v2 cutover -Issue #240 is the release handoff, not permission to publish an unverified -dependency. The exact v2 GA asset, checksum, and provenance must exist before -any downstream pin changes. +Issue #240 is the first-party promotion handoff. The exact v2 GA asset, +checksum, and provenance now exist; downstream pins and the Homebrew formula +must still be promoted to that immutable release. ## Inventory and order @@ -19,9 +19,10 @@ inventory. The release order is: namespaced test expectations; and 5. verify installed, vendored, bundled, and rollback paths in every consumer. -The cutover is blocked while `release_status` is `pending-ga-asset`. This is a -deliberate fail-closed state; changing a version string before the asset exists -would make a reproducible install impossible. +The release asset gate is satisfied when `release_status` is `published`, the +archive SHA256 matches the uploaded canonical bundle, and the provenance asset +names the exact merge commit. Consumer promotion remains fail-closed until +each pin and formula points at that same commit and passes its hosted checks. ## Verification and rollback @@ -39,6 +40,6 @@ release notes, then resume from the failed consumer after a reviewed fix. ## Current state Base's `basectl help` integration defect is fixed in the merged issue-backed PR -above and validated locally against the v2 API. Base Demo and Homebrew remain -intentionally unchanged until the v2 GA artifact is published; their current -v1.4 pins are historical inputs to the final cutover checklist. +above and validated locally against the v2 API. Base and Base Demo currently +retain their verified RC pins while the GA promotion PRs are prepared; the +Homebrew stable formula remains v1.4.0 until its GA formula PR lands. diff --git a/first-party-cutover.yaml b/first-party-cutover.yaml index a7497bc..4eef57b 100644 --- a/first-party-cutover.yaml +++ b/first-party-cutover.yaml @@ -1,9 +1,9 @@ schema_version: 1 target_release: 2.0.0 -release_status: pending-ga-asset +release_status: published required_asset: tag: v2.0.0 - sha256: publish-with-ga-release + sha256: 73d6f92fab8f1a8ded7f3b4312ebbe51aa8ec0c16eacf18c2d8fa23fb5664333 provenance: required publish_order: - base-bash-libs @@ -15,12 +15,12 @@ consumers: repository: basefoundry/base tracker: https://github.com/basefoundry/base/issues/1880 pull_request: https://github.com/basefoundry/base/pull/1881 - current_state: rc-pin-merged-pending-ga + current_state: ga-published-pending-pin - name: base-demo repository: basefoundry/base-demo tracker: base-bash-libs-240 - current_state: rc-pin-merged-pending-ga + current_state: ga-published-pending-pin - name: homebrew-base repository: basefoundry/homebrew-base formula: Formula/base-bash-libs.rb - current_state: rc-formula-rehearsed-stable-unchanged + current_state: ga-published-pending-formula From e4ef92669122caa0e971b90ba83e966b5df42d02 Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Sat, 15 Aug 2026 08:02:59 +0530 Subject: [PATCH 2/2] test: accept published GA cutover state --- tests/first-party-cutover.bats | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/first-party-cutover.bats b/tests/first-party-cutover.bats index 3d8aa03..c711a40 100644 --- a/tests/first-party-cutover.bats +++ b/tests/first-party-cutover.bats @@ -4,13 +4,13 @@ setup() { repo_root="$(cd "${BATS_TEST_DIRNAME}/.." && pwd -P)" } -@test "cutover check is fail-closed before GA and inspectable in pending mode" { +@test "cutover check accepts the published GA asset" { run "$repo_root/scripts/first-party-cutover" check - [ "$status" -eq 1 ] - [[ "$output" == *"locked until"* ]] + [ "$status" -eq 0 ] + [[ "$output" == *"structurally valid"* ]] run "$repo_root/scripts/first-party-cutover" check --allow-pending [ "$status" -eq 0 ] - [[ "$output" == *"PENDING release_status=pending-ga-asset"* ]] + [[ "$output" == *"structurally valid"* ]] } @test "cutover check detects legacy Base symbols" {