Repository navigation
release: 0.3.0 #146
Description
Existing issue check
- I searched open and closed issues. 0.2.0 used install: pin the one-line installer to a release and decide on archive signing #95 and PR release: 0.2.0 #122; nothing tracks 0.3.0.
Outcome
Release 0.3.0, a minor release under ADR 0022: it adds a capability, and operators must act on the new browser floor. What changes since 0.2.0, per CHANGELOG.md Unreleased:
- Added: the complete installation export (export: one complete installation export an agency can leave with #98, feat(export): one complete installation export an agency can leave with #130).
- Changed:
- SvelteKit 3 and Vite 8 (deps(web): SvelteKit 3, Vite 8, and current web tooling #140);
- Rust 1.99 and SQLite 3.51 (deps(rust): Rust 1.99 and current crates (sqlx 0.9 and five majors) #139);
- browser floor: Chrome/Edge 111+, Firefox 114+, Safari 16.4+.
- Fixed:
doctor's migration verdict (fix(doctor): report every migration history serve would refuse #144, ADR 0029).
No migration since 0.2.0 (git diff v0.2.0 -- crates/consolebook-server/migrations is empty), so upgrading from 0.2.0 migrates nothing.
Steps
- Release PR:
- version 0.3.0 in
Cargo.toml/Cargo.lockandweb/package.json/package-lock.json;tests/release_version.rschecks they agree; - CHANGELOG
[0.3.0] - 2026-10-15, with a summary; - README status, the roadmap's release baseline and operability list, and the install guide's
--versionexample.
- version 0.3.0 in
- Gates and merge: full proof, then hosted checks, then merge.
- Tag and release: tag
v0.3.0on the merge commit. The release workflow builds, attests, and publishes; releases are immutable once published. - Post-release verification, as on install: pin the one-line installer to a release and decide on archive signing #95:
- the one-line install in a throwaway prefix;
- checksums;
gh attestation verifyon every asset with the signer workflow, source ref, and source digest, plus negative controls. This first exercisesattest-build-provenancev4.2.2, which closes ci: update the pinned actions and keep dependencies current with Dependabot version updates #137.
- Preview: upgrade the preview on remi to 0.3.0 by rerunning the installer from the attested archive (
docs/preview.md), and verify it.
Acceptance criteria
-
v0.3.0is published with all six assets, attested and verified, and the one-liner installs 0.3.0. - The preview reports 0.3.0, and
doctorreportsokandwarnonly.
Execution record
- Authority: the maintainer, 2026-10-15, chose "Cut 0.3.0": the release PR, the tag, post-release verification, and the preview upgrade.
Activity
release: 0.3.0 (#147)
TusanHomichi commentedon Oct 15, 2026
Release PR merged: #147 merged as
dcdb9dcbecd0e9161e278009c76def7adaa56d59. Its tree9b1c0ce6is identical to the proven candidatedb9c80d.--versionprintedconsolebook 0.3.0 (db9c80db674c); receipt sha256b7f0fe9e….Tagged: annotated
v0.3.0(tag object53307586) ondcdb9dc, pushed 2026-10-15T23:09Z. Release run 38821862819 is in progress.Next: post-release verification, then the preview upgrade.
TusanHomichi commentedon Oct 15, 2026
Released and verified (2026-10-15).
build-x86_64,build-aarch64andpublishall succeeded.isImmutable: true, the first immutable release (repo: enforce the contribution rules with GitHub settings #123), with all six assets.install.sheach match their.sha256.install.shis stampedRELEASED_VERSION="0.3.0", and the README'sreleases/latest/download/install.shserves the same bytes (sha256a6f91be0…).consolebook 0.3.0 (dcdb9dcbecd0).gh attestation verify(gh 2.102) passed on all six assets with--signer-workflow …/release.yml --source-ref refs/tags/v0.3.0 --source-digest dcdb9dcb… --deny-self-hosted-runners. Each digest is a verified subject, and the runner was GitHub-hosted. Negative controls: a tamperedinstall.shhas no attestation (404), and--source-ref refs/tags/v0.2.0is refused.install.shwas rerun from the verified tarball (--from), keeping its settings. The installer exited 0 with "Installed consolebook 0.3.0 (dcdb9dc)".0.2.0 / e4fc1d3to0.3.0 / dcdb9dc, databaseok.401, and the log shows Secure cookies.doctorexits 0 with every lineok, includingmigrations 16 applied, up to date(no migration, as the changelog says),initialized, 1 administrator(s)andbackup copy current./data/dev/home/.codex/tmp/consolebook-release-0.3.0-20261015.