chore: make release.sh the only release entrypoint - #65
Merged
Conversation
Four scripts could cut a release, three of them able to bypass the
correct flow. That contradicts the project's own rule ("ALWAYS use the
release script. NEVER bump versions or commit/tag/push manually") and is
the soil the v0.9.24 and v0.9.36 orphaned-tag incidents grew in.
Removed, all untouched since February and referenced by no workflow:
- publish.sh — hardcoded v0.2.24 against a current 0.9.36 and ran
`flutter pub publish` directly, so it could ship the working tree to
pub.dev with no tag, no version sync and no CI. Output was Chinese,
against the English-only rule.
- bump_version.dart — printed `git push origin main --tags` as step 4,
reproducing the exact non-atomic push that stranded two releases.
- bump_version.sh — updated 5 version files where release.sh updates 16,
so using it left the versions inconsistent.
The same push command was documented in CLAUDE.md and RELEASE_GUIDE.md,
so following either by hand hit the bug even with the script fixed. Both
now verify main matches origin/main first and push with --atomic naming
the single tag.
Remaining mentions in CHANGELOG.md and docs/CLEANUP_SUMMARY.md are
historical records and are left as they are.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #64. Fixing
release.shalone was not enough — three other scripts and two documents could still reproduce the incident.Summary
Four scripts could cut a release. Three of them bypassed the correct flow, contradicting the project's own rule in CLAUDE.md:
All three were last touched in February 2026 and are referenced by no workflow.
scripts/publish.shv0.2.24against a current0.9.36, and ranflutter pub publishdirectly — able to ship the working tree to pub.dev with no tag, no version sync and no CI. Output was Chinese, against the English-only rule.scripts/bump_version.dartgit push origin main --tagsas step 4 — the exact non-atomic push that stranded v0.9.24 and v0.9.36.scripts/bump_version.shrelease.shupdates 16, so using it left versions inconsistent across packages.The documented footgun
The same command was written into two docs, so following either by hand hit the bug even with
release.shfixed:CLAUDE.md→ Manual Release Steps.github/RELEASE_GUIDE.md→ Quick Manual ReleaseBoth now:
git fetch origin main git rev-parse main origin/main # must print the same SHA twice ... git push --atomic origin main refs/tags/vX.Y.Zwith a comment explaining that
--tagslets a tag through even when the branch update is rejected.Verification
CHANGELOG.md:1513anddocs/CLEANUP_SUMMARY.md:15still mentionpublish.sh, both historical records, left as they aregit push origin main --tagsno longer appears in any doc or script (the remaining hit isscripts/release.sh, fixed by fix(release): keep the tag on main and push it atomically #64 on its own branch)Note
docs/CLEANUP_SUMMARY.mdis a February snapshot that is already inaccurate in other ways — it placespublish.sh,install.shandPUBLISHING.mdat the repo root, none of which is true now. Retiring it is worth a separate decision, so I left it alone.🤖 Generated with Claude Code