- Fast-forward merge of phase/07-v0.1-backfill into milestone/v0.1-initial
- Annotated tag v0.1.7 created at dc67522
- Gitea release v0.1.7 published with orca-v0.1.7-linux-amd64.tar.gz
- Fix -> typo in release.sh notes block
(unbound variable under set -u; surfaced on first end-to-end run
of release.sh for v0.1.7). Patch is minimal and contained to the
release-notes echo line.
Layer 1 (Structural): scripts/backfill_releases.sh is mode 755,
171 lines, parses cleanly under 'bash -n'. .gitignore has '.env' on
line 11 (alongside '.env.local'). .ciagent/PHASE7_SECURITY_AUDIT.md
exists, 57 lines / 2574 bytes.
Layer 2 (Behavioral): idempotency path is EXISTING=$(tea releases list
...) | awk + 'grep -qx $TAG' skip branch (lines 52, 82-85). Error
paths: ': ${GITEA_TOKEN:?GITEA_TOKEN is required}' on line 37 exits
non-zero with a clear message when .env is missing; 'command -v'
guards on lines 38-40 exit 1 with 'err' for missing tea/go/tar.
Tarball naming on line 101 is orca-${TAG}-${OS}-${ARCH}.tar.gz,
matches the orca-<tag>-<os>-<arch>.tar.gz convention.
Layer 3 (Security): .env is sourced from a list of well-known paths
(lines 24-32) via 'set -a' ... '. file' ... 'set +a', so the token
is exported into the script's environment. The script never echoes
$ GITEA_TOKEN and never passes it as a CLI argument to 'tea' — the
'tea releases create' invocation on lines 161-165 carries --repo,
--title, --note-file, --asset, but no --token flag (tea reads it
from its own config). .gitignore now excludes .env (forward fix).
The pre-existing secret leak in 0cba1aa (verified: 'git show
--stat 0cba1aa' lists '.env | 2 ++') is documented in
PHASE7_SECURITY_AUDIT.md as P0 for human remediation out-of-band;
the existing token still works and the backfill ran successfully,
so the leak does not block this verify.
Layer 4 (Quality): 'go build ./...' exits 0 (clean). 'go vet ./...'
exits 0 (clean). Both P07 execute commits use 'fix(P07):' Conventional
Commits prefixes, and their ---ci--- blocks parse correctly (project,
phase, milestone, status, version, requirements.covered,
requirements.partial all present and well-formed).
Result: PASS on all 4 layers. Phase 7 is verified.
---ci---
project: orca
phase: 7
milestone: v0.1
status: verify
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
Layer-3 security audit during P07 EXECUTE found that .env (containing
GITEA_TOKEN) was committed in 0cba1aa during P00 and remained in git
history. The pre-P07 .gitignore only excluded .env.local, not .env.
This commit:
1. Adds .env to .gitignore alongside .env.local (forward fix — prevents
future re-tracking).
2. Documents the pre-existing leak in .ciagent/PHASE7_SECURITY_AUDIT.md
with mitigation steps and required human actions (token rotation,
history rewrite, access-log audit, CI secret scanning).
The backfill script itself (commit de69788) does not leak the secret: it
sources .env from disk and never echoes or passes it on the command line.
The leak is upstream of P07 and is documented as P0 for the human to
remediate out-of-band.
---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
The v0.1 milestone COMPLETE commit (d76ff84) was tagged v0.2.0 and the
per-phase tags v0.1.1..v0.1.6 were created, but the standing rule
'every phase tag produces a Gitea release' was only codified in P06
(RELEASE_POLICY.md) and never applied retroactively.
This commit adds scripts/backfill_releases.sh, an idempotent helper that:
- iterates over v0.1.1..v0.1.6 and v0.2.0
- skips tags that already have a release
- builds the orca binary from the milestone branch HEAD (which includes
the post-COMPLETE entry-point fix and workflow-block commits)
- injects the historical version via -ldflags
- packages a per-tag tarball (orca-<tag>-<os>-<arch>.tar.gz)
- creates a Gitea release with the tarball as an asset, and release
notes that include the phase summary and a v0.2.0 milestone recap
After backfill, the v0.1 milestone is fully released end-to-end and the
discipline carries forward into v0.2.
---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
Adds a top-level workflow block to .ciagent/config.json with the four
standing rules for v0.2+ and all future milestones:
1. no_hitl: true — full automation, no human-in-the-loop
2. merge_strategy — fast-forward or rebase-then-fast-forward only;
no merge-commit-no-ff, no squash
3. release_flow_per_phase: true — every phase tag produces a Gitea release
(already in .ciagent/RELEASE_POLICY.md, now
also enforced in config.json)
4. branching — main < milestone/<slug> < phase/<NN>-<slug>
phase branches FF into milestone;
milestone rebases onto main then FF.
---ci---
project: orca
phase: 0
milestone: v0.1
status: execute
---/ci---
The P01 ship commit (503923b) merged docs and metadata for the CLI
skeleton phase but the cmd/orca/main.go entry point was never committed
to the milestone branch. It existed only as a working-tree file.
This commit adds the 15-line entry point that wires cli.Execute() into
a runnable orca binary. The unbuilt file was shadowing the build via
go's automatic working-tree pickup.
---ci---
project: orca
phase: 0
milestone: v0.1
status: fix
---/ci---
Captures the new standing rule: every phase tag MUST produce a Gitea
release (not just a git tag), and milestone tags must use the next
version per the feature-milestone promotion logic.
---ci---
project: orca
phase: 6
milestone: v0.1
status: complete
---/ci---
Jon Chery