Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/setup/marketplace.md
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ can say so, because it is the floor everything else is managed from.
|---|---|---|
| `magpie-security` | 15 | ~1.1k |
| `magpie-setup` | 10 | ~0.7k |
| `magpie-release-management` | 10 | ~1.4k |
| `magpie-release-management` | 10 | ~0.8k |
| `magpie-pr-management` | 8 | ~0.8k |
| `magpie-issue` | 8 | ~0.7k |
| `magpie-repo-health` | 7 | ~0.6k |
Expand Down
19 changes: 6 additions & 13 deletions plugins/magpie-release-management/skills/announce-draft/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,24 +8,17 @@ mode: Drafting
requires_config:
- release-management-config.md
description: |
Draft the `[ANNOUNCE]` email body and open (not merge) the site-bump PR
for a promoted release of `<upstream>`. Reads release metadata from the
planning issue and `<project-config>/release-management-config.md`;
produces a ready-to-copy `[ANNOUNCE]` subject + body and proposes the
site-bump PR. Never sends mail and never merges the PR without explicit
RM confirmation.
Draft the `[ANNOUNCE]` email and open (never merge) the site-bump PR for
a promoted release of `<upstream>`. Never sends mail.
when_to_use: |
Invoke when a Release Manager says "draft the announce email for
<version>", "write the [ANNOUNCE] for <version>", "announce the
<version> release", or similar. Appropriate after the promote step
is confirmed and the planning issue carries the `promoted` label.
Standalone: does not require `release-vote-draft` to have run in
the same session — only that the release was promoted.
"draft the announce email for <version>", "write the [ANNOUNCE]",
"announce the <version> release", once the planning issue carries
`promoted`.
argument-hint: "<version> [--planning-issue <url>]"
capability: capability:resolve
surface_hash: sha256:edffafcd9d9948ab
license: Apache-2.0
measured_tokens: 6725
measured_tokens: 6612
---

<!-- SPDX-License-Identifier: Apache-2.0
Expand Down
22 changes: 8 additions & 14 deletions plugins/magpie-release-management/skills/keys-sync/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,25 +8,19 @@ mode: Drafting
requires_config:
- release-management-config.md
description: |
Draft the diff that adds the Release Manager's public key to the
project's KEYS file (`<keys-file-url>`), emit a paste-ready `svn`
(or backend-equivalent) command sequence, remind the RM to upload to
the configured keyserver, and validate the key meets the ASF strength
floor. Never commits, never holds or reads the private key. Runs during
release preparation, before RC signing begins.
Add the Release Manager's public key to the project KEYS file: check it
meets the ASF strength floor, draft the KEYS diff, and emit the `svn`
(or backend) commands and keyserver reminder for the RM to run. Never
holds the private key, never commits.
when_to_use: |
Invoke when a Release Manager says "add my key to KEYS", "sync my
signing key for the release", "run release-keys-sync", or any variation
on ensuring their public key appears in the project KEYS file before
artefacts are signed. Typically runs once per RM per project, during
release prep before `release-rc-cut`. A no-op — with a graceful report —
when the configured fingerprint is already present in KEYS for the same
UID.
"add my key to KEYS", "sync my signing key", "run release-keys-sync",
once per RM during release prep, before `release-rc-cut`. A no-op when
the key is already in KEYS.
argument-hint: "[--fingerprint <fp>] [--keys-url <url>] [--keyserver <host>]"
capability: capability:resolve
surface_hash: sha256:61e10c986bb0d3ec
license: Apache-2.0
measured_tokens: 4677
measured_tokens: 4593
---

<!-- SPDX-License-Identifier: Apache-2.0
Expand Down
37 changes: 10 additions & 27 deletions plugins/magpie-release-management/skills/prepare/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,38 +9,21 @@ requires_config:
- release-management-config.md
- release-trains.md
description: |
Draft release preparation artefacts for `<upstream>`: the planning
issue, the version-bump and changelog prep PR (which, on a project's
first release, includes a guided review of what the `git archive`
source artefact ships and the `.gitattributes` `export-ignore`
entries that keep VCS/CI/editor metadata out), or the post-release
development-version bump PR. For ASF projects, the one-time
`automated-signing` setup drafts the Infra key request, the Security
Team notification and the reproducible-build workflow PR. Reads
release metadata from `<project-config>/release-trains.md` and
`<project-config>/release-management-config.md`. Every output is a
draft confirmed by the Release Manager before filing; the agent never
marks a PR ready, never merges, never closes any artefact, never files
a ticket and never sends mail.
Draft release-preparation artefacts for `<upstream>`: the planning
issue, the version-bump and changelog prep PR (with the first-release
review of what the source archive ships), the post-release dev-version
bump PR, and, for ASF projects, the one-time `automated-signing` setup.
Every output is a draft the RM confirms; nothing is merged, filed or sent.
when_to_use: |
Invoke when a Release Manager says "prepare the <version> release",
"draft the planning issue for <version>", "open the prep PR for
<version>", "write the version bump for <version>", "draft the
post-release bump for <version>", "review what goes into the source
release", "set up CI release signing", or similar. Covers three
lifecycle moments: planning-issue creation (`/release-prepare
<version>`), version-bump prep PR (`/release-prepare prep <version>`,
which also runs the first-release source-archive review), and
post-release dev-version bump (`/release-prepare post <version>`);
plus the version-less, 🪶 ASF-only `/release-prepare
automated-signing` setup. Requires
`<project-config>/release-management-config.md` and
`<project-config>/release-trains.md` to exist.
"prepare the <version> release", "draft the planning issue", "open the
prep PR", "draft the post-release bump", "review what goes into the
source release", "set up CI release signing". Sub-commands: `plan`
(default), `prep`, `post`, `automated-signing`.
argument-hint: "[prep | post] <version> [--review-archive] | automated-signing"
capability: capability:resolve
surface_hash: sha256:43e928f52996ee1b
license: Apache-2.0
measured_tokens: 5544
measured_tokens: 5313
---

<!-- SPDX-License-Identifier: Apache-2.0
Expand Down
25 changes: 7 additions & 18 deletions plugins/magpie-release-management/skills/rc-cut/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,29 +9,18 @@ requires_config:
- release-build.md
- release-management-config.md
description: |
Emit the paste-ready command sequence to tag an RC, build artefacts
(the source archive reproducibly, via `git archive` + `.gitattributes`
`export-ignore` + the framework's `repro-archive` tool), optionally
self-check reproducibility, sign each artefact, generate checksums, and
stage them to the adopter's distribution backend. Covers Steps 4–5 of
the release-management lifecycle. Never runs any command locally — all
sequences are emitted for the Release Manager to execute on their own
machine with their own key and ASF credentials. Blocks while the
first-release `.gitattributes` review (`release-prepare prep`) is
outstanding. For ASF projects with `automated_release_signing: enabled`,
emits the tag push that triggers the CI build instead of local
sign/stage commands.
Emit the paste-ready commands to tag an RC, build the source archive
reproducibly, sign, checksum and stage it to the distribution backend
(or, with ASF automated signing, the tag push that triggers CI). Never
runs them: the RM does, with their own key and credentials.
when_to_use: |
Invoke when a Release Manager says "cut rc1 for <version>", "prepare
rc<N> for <version>", "tag the release candidate", "stage the RC to
dist/dev", or similar. Run after the prep PR (`release-prepare prep`)
is merged. Skip if the prep PR has not yet merged or if a tag for this
RC number already exists on the remote.
"cut rc1 for <version>", "tag the release candidate", "stage the RC to
dist/dev". Run after the prep PR merged; skip if that RC tag exists.
argument-hint: "<version> rc<N>"
capability: capability:resolve
surface_hash: sha256:60623e456e72bbf6
license: Apache-2.0
measured_tokens: 9695
measured_tokens: 9530
---

<!-- SPDX-License-Identifier: Apache-2.0
Expand Down
33 changes: 9 additions & 24 deletions plugins/magpie-release-management/skills/verify-rc/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,35 +9,20 @@ requires_config:
- release-build.md
- release-management-config.md
description: |
Read-only pre-flight verification of a staged release candidate (RC)
for `<upstream>`. Checks artefact integrity (GPG signatures and
checksums), Apache RAT licence headers, NOTICE/LICENSE completeness,
prohibited-binary absence (including `.pyc` / `__pycache__`),
published-JVM-artefact compliance (POM licence/developers/scm,
podling incubation disclaimer, companion `-sources.jar` /
`-javadoc.jar` with their own signatures and checksums), source-tree
integrity (no dangling symlinks or broken internal references),
version-string consistency, and — optionally, per
`release-build.md § Reproducibility checks` — reproducibility: the
source archive is rebuilt from the tag with `repro-archive` and
compared byte-for-byte with the staged artefact, and convenience
binaries are rebuilt and compared (mandatory for ASF projects with
automated release signing, as the policy's validation on trusted
hardware). Emits a structured PASS / PASS-WITH-WARNINGS / FAIL report.
Makes no state change; a `--post-to <planning-issue>` flag proposes a
comment for explicit RM confirmation before any posting.
Read-only verification of a staged RC of `<upstream>`: signatures and
checksums, RAT headers, NOTICE/LICENSE, prohibited binaries, JVM
artefacts, source-tree integrity, version strings, and optionally
reproducibility. Emits a PASS / PASS-WITH-WARNINGS / FAIL report;
`--post-to` proposes a planning-issue comment for the RM to confirm.
when_to_use: |
Invoke when a Release Manager or voter says "verify rc N for
<version>", "run pre-flight on <version>-rcN", "check the RC
artefacts for <version>", or similar. Appropriate during the RC
pre-flight phase — before the `[VOTE]` thread is opened (RM's
self-check) or during the vote window (any voter's dev loop). Can be
run standalone with no other release-* skill in the session.
"verify rc N for <version>", "run pre-flight on <version>-rcN", "check
the RC artefacts", by the RM before the `[VOTE]` or by any voter during
it. Runs standalone.
argument-hint: "<version>-rcN [--post-to <planning-issue-url>] [--skip-repro] [--trusted-hardware]"
capability: capability:triage
surface_hash: sha256:ed944a58facaae21
license: Apache-2.0
measured_tokens: 9299
measured_tokens: 9075
---

<!-- SPDX-License-Identifier: Apache-2.0
Expand Down