feat: v1-release-readiness — versioning, dry-run, CI, repo hygiene, cooldown doc#2
Merged
Merged
Conversation
…ooldown doc split
Bundles A2 + C1-C5 from openspec/changes/v1-release-readiness/.
C6 (release tag + blogpost) blijft expliciet handmatig.
C1 — Versioning
- VERSION (0.9.0) + ws_version()/ws_handle_version() in common/lib.sh
- --version/-V op alle 9 user-facing entrypoints; incident-token-revoke.sh
houdt self-contained inline-variant
C5 — Dry-run
- --dry-run + WS_DRY_RUN=1 propagation; helpers ws_is_dry_run() en
ws_run_or_print() in lib.sh; ws_write_unit() in install-timers.sh
- install-base.sh helpers (require_root, freshclam_safe, rkhunter_init,
enable_clamav_services) zijn dry-run-aware
- bootstrap.sh skip't root-check in dry-run zodat CI/audit zonder sudo werkt
A2 — Cooldown doc-split
- docs/supply-chain-cooldown.md staat-op-zichzelf; README-sectie 2
verkort tot 3-4 zinnen + link
C3+C4 — Repo hygiene + README
- LICENSE (volledige EUPL-1.2 van SPDX license-list-data)
- CONTRIBUTING.md, .github/ISSUE_TEMPLATE/{bug,distro_support,config}
- README herstructureerd (badges, scope vooraan, drie lagen elk eigen H2
met wat/voor wie/snelle start, License-sectie onderaan)
- clone-URL gecorrigeerd naar MWest2020/
C2 — CI matrix
- .github/workflows/smoke.yml met alma9 + ubuntu2404 + archlatest
- bootstrap.sh --dry-run, check.sh, install-pm-cooldown.sh --dry-run
OpenSpec
- openspec/ scaffolding + proposal + design + tasks + 3 spec-deltas
- design.md vangt zeven trade-offs (boring/auditable per cluster)
- openspec validate --strict groen
Niet bij deze commit: .claude/ (gitignored), C6 release, bats tests, doc-review.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pre-existing failure on main since 2026-05-13: ludeeus/action-shellcheck@2.0.0
defaults to severity=style, which flags SC1091 (un-followable source notes)
and SC2016 (literal $HOME in user-facing PATH-hint strings — intentional).
Both are filtered at warning-level, which matches what local pre-commit uses
(.pre-commit-config.yaml: --severity=warning).
Boring + auditable: CI mirrors local. Geen drift, geen verbergen — als
shellcheck warning-of-hoger vindt, faalt CI én pre-commit.
Ook: README shellcheck-badge was statisch ("clean") en daarom misleidend
zolang het workflow rood stond. Vervangen door dynamische workflow-badge.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bundles A2 + C1-C5 from
openspec/changes/v1-release-readiness/. C6 (release tag + blogpost) blijft expliciet handmatig.VERSIONfile +ws_version()/ws_handle_version()incommon/lib.sh;--version/-Vop alle 9 user-facing entrypoints.--dry-runflag +WS_DRY_RUN=1env-var propagation; helpersws_is_dry_run(),ws_run_or_print(),ws_write_unit(). Geen side effects, output copy-paste-baar.docs/supply-chain-cooldown.mdstaat-op-zichzelf; README-sectie 2 verkort tot 3-4 zinnen + link.LICENSE(EUPL-1.2 canoniek),CONTRIBUTING.md,.github/ISSUE_TEMPLATE/*, README herstructureerd (badges, scope vooraan, drie lagen elk eigen H2, License-sectie onderaan), clone-URL gecorrigeerd naarMWest2020/..github/workflows/smoke.ymlmetalma9+ubuntu2404+archlatest(officiële Docker Hub images).Niet bij deze PR
.claude/— gitignored op verzoek.Design keuzes
Vastgelegd in
openspec/changes/v1-release-readiness/design.md:cat VERSIONals bewijs--dry-runpropageert via env-var én flagLICENSE-file--versionop CLIs, niet op librariesPre-flight checks
bash common/check-shell-headers.sh --all .→ 17 files conform ✓shellcheck --severity=warning -xover alle .sh files → clean ✓openspec validate v1-release-readiness --strict→ groen ✓/security-reviewop deze branch → no findings above confidence threshold ✓bootstrap.sh --version/--dry-run, edge caseVERSIONontbreekt, env-var-only propagatie viaWS_DRY_RUN=1— alle exit 0, geen side effects ✓Test plan
smokeworkflow groen op alle 3 matrix-distros (alma9, ubuntu2404, archlatest)docs/supply-chain-cooldown.mdcold — begrijpt een lezer zonder context het mechanisme en de overrides? (taak 1.4)gh pr checksgroen voor mergeAfter merge (C6 — handmatig)
VERSION→1.0.0, CHANGELOG-entry onder## v1.0.0 (YYYY-MM-DD)git tag -a v1.0.0 -m "v1.0.0 — initial public release"+ pushgh release create v1.0.0met CHANGELOG-fragment als body🤖 Generated with Claude Code