Repository navigation
sync(#1874): main to dev after v5.10.1 release - #1876
Conversation
## Summary - **Releases v5.10.1** — see CHANGELOG section below for the full list of changes included in this release - **CHANGELOG.md updated** — new section prepended at the top with the grouped entries and PR refs - **Auto-tag on merge** — `.github/workflows/auto-tag-on-release-pr-merge.yml` will tag the squash commit on main and create a GitHub Release entry automatically when this PR merges (AgDR-0076) - **Release provenance recorded** — a `Released-From` trailer captures the exact `dev` SHA this release was cut from, so the next release's changelog range is deterministic instead of inferred (AgDR-0094, #872) ## CHANGELOG ## [v5.10.1] — 2026-10-24 Patch release — 4 improvements. ### Changed (refactor / chore / docs) - (#1873) harden the terraform-ci golden-path template — ce979c5 - (#1872) state the hook threat model in SECURITY.md — 953d450 - (#1868) add an after-the-release checklist to /release — f9fd80d - (#1869) credit five missing issue authors — 0024f0f ### Thanks - @SecFathy (Mohammed Fathy) reported the problems that #1872 and #1873 fix. ## Migration script - [x] A no-op migration script `.claude/migrations/v5.10.0-to-v5.10.1.sh` is included, and `docs/upgrading.md`'s "What each migration does" table has a matching row. See `.claude/migrations/README.md`. ## Testing 1. After merge, confirm CI creates tag `v5.10.1` on `main` (check the `auto-tag-on-release-pr-merge` workflow run) 2. Verify `git describe --tags --abbrev=0 upstream/main` returns `v5.10.1` 3. Run `/release-sync v5.10.1` to sync main→dev and prevent squash divergence 4. Verify the squash commit's message carries the trailer: `git log -1 --pretty=format:'%(trailers:key=Released-From,valueonly)' v5.10.1` Refs #1874 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- ## Glossary | Term | Definition | |------|------------| | Squash merge | GitHub merges all commits on the PR branch into a single commit on main; the branch HEAD is discarded and the resulting main tip has a new SHA | | Auto-tag | The `auto-tag-on-release-pr-merge.yml` workflow fires on `pull_request` → `closed` + `merged` for `release/v*` branches, tags `github.sha` (the squash commit), and creates a GitHub Release | | Ancestry guard | `git merge-base --is-ancestor <sha> main` — fails if the tag would not be reachable from main, preventing a mis-placed tag like v2.3.0 | | `/release-sync` | The mandatory follow-up skill that merges main→dev after a squash-merge release, preventing SHA divergence accumulation | | `Released-From` trailer | A git trailer (`Key: value` in the commit message's final paragraph) recording the exact `dev` SHA this release was cut from — `bin/release-changelog.sh` reads it back for the next release's changelog range (AgDR-0094) | Released-From: ce979c5
Squash-merge divergence from the v5.10.1 release PR creates phantom divergence between main and dev. This merge makes the v5.10.1 squash commit an ancestor of dev so future dev to main release PRs only see genuinely-new commits. Refs #1874
me2resh
left a comment
There was a problem hiding this comment.
CHANGES REQUESTED. The merge commit is correct. The PR body has no Glossary section, and the Glossary is mandatory. Next action: add the Glossary table from the /release-sync PR body template to the PR body. The head SHA does not change, so a delta re-review of the body is sufficient.
Code Review: PR #1876
Commit: 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2
Scope: Full
Summary
This PR merges main into dev after the v5.10.1 release. The head is a two-parent merge commit. Parent 1 is the dev tip ce979c5c. Parent 2 is the release squash commit fa691107, which tag v5.10.1 names. The merge makes the release squash commit an ancestor of dev. The diff against dev contains only the release's own edits.
Acceptance Criteria
| Issue | Criterion | Status | Evidence |
|---|---|---|---|
| #1874 | Release PR release/v5.10.1 to main is open, and its changelog lists #1869, #1868, #1872 and #1873. |
Met | The release PR merged as fa691107. CHANGELOG.md on the head has the v5.10.1 entry with all four PR numbers. |
| #1874 | The no-op migration script and its docs row are in the release. | Met | .claude/migrations/v5.10.0-to-v5.10.1.sh (mode 100755, exits 0) and the docs/upgrading.md table row are in fa691107 and in this head. |
| #1874 | After merge, tag v5.10.1 exists on main and the squash commit carries a readable Released-From trailer. |
Met | The forge tag v5.10.1 is annotated and peels to fa691107, which is the forge main tip. The trailer reads ce979c5c63805a5f7d61a12e7a7ff3c04e8fa98f. |
| #1874 | /release-sync v5.10.1 is done. |
Not verifiable | This PR is the sync. The criterion is complete only after this PR merges with --merge. Check after merge: git merge-base --is-ancestor fa691107 upstream/dev exits 0. |
Checklist Results
- Architecture & Design: N/A. The PR adds no new code. It brings release content into
dev. - Code Quality: ✅ Pass. The only script is the no-op migration from the release. It uses
set -u, honorsAPEXYARD_MIGRATION_QUIET, and exits 0. - Testing: ✅ Pass. No new tests are necessary. The head tree is identical to the
maintree, which CI already ran on the release PR. CI is green on this head. - Security: N/A for this pass. No secret, auth, or hook file changes against
dev. Gate integrity belongs to the Security Auditor. - Performance: N/A. Docs and one no-op script.
- PR Description & Glossary: ❌ Fail. The body has no
## Glossarysection. See Issues Found. The ticket link is correct:Refs #1874, no closing keyword, and no session URL. - Summary Bullet Narrative: ✅ Pass. Each bullet states the change and its effect.
- Technical Decisions (AgDR): N/A. A routine sync. The merge strategy is already recorded in AgDR-0053 and AgDR-0170.
- Adopter Handbooks: N/A. No handbook applies to a docs-and-merge sync.
- Fallow Static Analysis (JS/TS): N/A. The diff has no JS or TS file.
Issues Found
- Missing Glossary (blocking).
.claude/rules/pr-quality.md§ "Glossary (MANDATORY)" states that a PR without a Glossary gets a changes-requested result, with no exceptions. The/release-syncPR body template also includes a Glossary. Fix: copy the template's Glossary table into the PR body. A body edit does not change the head SHA.
Note: the Rex review of #1865 (the v5.10.0 sync) treated the same gap as advisory. That result did not agree with the rule. This review follows the rule.
Suggestions
- suggestion: The body omits the template's
## Backgroundsection. Consider adding it so the sync PR matches the template. Advisory. - nit (pre-existing on
main, not introduced by this PR): the new SecFathy row in README "Issue contributors" links to the profile page. The other rows link to an issue search for that author. If the report came through a non-issue channel, the profile link is correct. Advisory only.
Validation
- Merge parents:
git rev-list --parents -n 1 31f4d98agivesce979c5candfa691107. The forgedevref isce979c5c. The forgemainref isfa691107.v5.10.1^{commit}isfa691107. - Diff against
dev:git diff --stat ce979c5c 31f4d98ashows 4 files, 41 insertions, 0 deletions. The files areCHANGELOG.md(v5.10.1 entry), the migration script, thedocs/upgrading.mdrow, and the README SecFathy row. - Diff against
main: empty. The head tree id and themaintree id are both5f70026f. - Conflict:
git show --remerge-diff 31f4d98ashows one conflict inREADME.md. The resolution keeps main's side, the SecFathy row betweensamahaliandsts1078, and removes the markers. No other line changed. A search for conflict markers inREADME.md,CHANGELOG.mdanddocs/upgrading.mdat the head finds none. The other README content is the same as ondev. - CHANGELOG:
git diff --quiet fa691107 31f4d98a -- CHANGELOG.mdexits 0. No carry-forward commit is necessary. - Step 5c:
upstream/dev..upstream/mainhas one non-merge commit,fa691107. A reverse-apply run in a scratch export did not run, because the reviewer mutation lock stopped the setup command. The tree equality above is stronger evidence: the head tree is identical tofa691107's tree, so all of that commit's content is present. - CI (read once, head
31f4d98a): CodeQL, Analyze (actions), hook test suite, hook tests (linux jq-1.7), Verify Ticket ID, markdownlint-cli2, records-lint and tier pass. nightly-failure and conformance are skipped.
Verdict
CHANGES REQUESTED
The merge commit, the conflict resolution, the CHANGELOG, and the content check are all correct. The only blocker is the missing Glossary, which the PR quality rule makes mandatory. After the body edit, request a delta re-review. Merge with --merge only.
🤖 Reviewed by Rex (Code Reviewer Agent)
📌 Reviewed commit: 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2
me2resh
left a comment
There was a problem hiding this comment.
APPROVED. The PR body now has a Glossary, so the one blocker is resolved. Next action: get the per-PR human approval, then merge with --merge only.
Code Review: PR #1876
Commit: 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2
Scope: Delta re-review, 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2..31f4d98a5be9dd1308cb0f1cca801e0b315c80c2 (PR body only)
Summary
The head did not change. Only the PR body changed: it adds a ## Background section and a ## Glossary table with three terms. Prior review: 5639174545, at the same commit. The acceptance criteria results from that review stay the same. Three of the #1874 criteria are Met. "/release-sync v5.10.1 is done" is Not verifiable until this PR merges with --merge.
Checklist Results
- PR Description & Glossary: ✅ Pass. The Glossary defines squash divergence, main-only content, and the post-merge content check. Each definition agrees with
/release-syncsteps 5 and 5c. The Background is correct: a plain merge stops on every conflict, and the SecFathy row is main-only content.#1348and#1394are real issues. The body hasRefs #1874, no closing keyword, no session URL, and no private path or identifier. - Architecture, Code Quality, Testing, Security, Performance, AgDR, Handbooks, Fallow: unchanged from review 5639174545. The code did not change, so these checks were not run again.
Issues Found
- Missing Glossary (blocking, review 5639174545): resolved. The body now has a
## Glossarytable. - Missing Background (suggestion): resolved.
- SecFathy row links to the profile page (nit, already on
main): not touched. Advisory only. - New findings: None.
Validation
- Current: the forge head is
31f4d98a5be9dd1308cb0f1cca801e0b315c80c2, the same as the prior review'scommit_id. The body was read from the forge in this run. - CI: the earlier read in this run, at the same head, showed all checks pass, with nightly-failure and conformance skipped. The hook stopped a second CI read in the same run, so CI was not read again. The head did not change, so that result still applies to this commit.
- Merge parents, the tree equality with
main, the conflict resolution, and the CHANGELOG match: from review 5639174545. Not run again.
Verdict
APPROVED
The only blocker is resolved and the new body text is correct. The merge commit is still correct. Merge with --merge only, never --squash or --rebase.
🤖 Reviewed by Rex (Code Reviewer Agent)
📌 Reviewed commit: 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2
Summary
dev. The nextdevtomainrelease PR then shows only new commits.README.md, the SecFathy credit row added on the release branch. The CEO chose to keep main's side, so the row stays betweensamahaliandsts1078.CHANGELOG.mdalready matchesmainafter the merge.FAILED_COMMITSis empty. The one main-only commit still reverse-applies on this branch.Background
Each release squash-merges
devintomain. The squash commit is not ondev, so the next release PR conflicts on the same changes. This PR mergesmainintodevwith a plain merge, so the squash commit becomes an ancestor ofdev. A plain merge stops on every conflict, becausemaincan carry content thatdevdoes not have (#1348, #1394). The SecFathy row is such content.Testing
git merge-base --is-ancestor fa6911078bb3c91af457290cd2c7e8bd91843746 upstream/devexits 0.git log upstream/dev..upstream/main --onelinereturns nothing.--merge, never--squashor--rebase.Refs #1874
Glossary
mainthatdevdoes not contain. The next release PR then conflicts on changes thatdevalready has.mainand not ondev, for example an edit made on the release branch before the squash./release-sync: each main-only commit's patch must still reverse-apply on the sync branch.🤖 Generated with Claude Code