- Fast-forward merge of phase/07-v0.1-backfill into milestone/v0.1-initial
- Annotated tag v0.1.7 created at dc67522
- Gitea release v0.1.7 published with orca-v0.1.7-linux-amd64.tar.gz
- Fix -> typo in release.sh notes block
(unbound variable under set -u; surfaced on first end-to-end run
of release.sh for v0.1.7). Patch is minimal and contained to the
release-notes echo line.
Layer-3 security audit during P07 EXECUTE found that .env (containing
GITEA_TOKEN) was committed in 0cba1aa during P00 and remained in git
history. The pre-P07 .gitignore only excluded .env.local, not .env.
This commit:
1. Adds .env to .gitignore alongside .env.local (forward fix — prevents
future re-tracking).
2. Documents the pre-existing leak in .ciagent/PHASE7_SECURITY_AUDIT.md
with mitigation steps and required human actions (token rotation,
history rewrite, access-log audit, CI secret scanning).
The backfill script itself (commit de69788) does not leak the secret: it
sources .env from disk and never echoes or passes it on the command line.
The leak is upstream of P07 and is documented as P0 for the human to
remediate out-of-band.
---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
The v0.1 milestone COMPLETE commit (d76ff84) was tagged v0.2.0 and the
per-phase tags v0.1.1..v0.1.6 were created, but the standing rule
'every phase tag produces a Gitea release' was only codified in P06
(RELEASE_POLICY.md) and never applied retroactively.
This commit adds scripts/backfill_releases.sh, an idempotent helper that:
- iterates over v0.1.1..v0.1.6 and v0.2.0
- skips tags that already have a release
- builds the orca binary from the milestone branch HEAD (which includes
the post-COMPLETE entry-point fix and workflow-block commits)
- injects the historical version via -ldflags
- packages a per-tag tarball (orca-<tag>-<os>-<arch>.tar.gz)
- creates a Gitea release with the tarball as an asset, and release
notes that include the phase summary and a v0.2.0 milestone recap
After backfill, the v0.1 milestone is fully released end-to-end and the
discipline carries forward into v0.2.
---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
Jon Chery
cloudinit-bot