Repository navigation
Bump version to 2.0.0 - #711
Merged
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ryanwelcher
added a commit
that referenced
this pull request
Oct 26, 2026
) ## Why `RELEASING.md` described each step but left most of the commands to the person: how to check the macOS artifact, how to find the merged commit, which tag the release notes start from, how to tell the docs deploy actually ran. That makes a release slow to do by hand and easy for an agent to get wrong. ## What changes - **`RELEASING.md` gets the commands.** Start-state checks and the `release/X.Y.Z` branch name, the bump diff check, the macOS artifact checks (mount the `.dmg`, list the `app.asar` root, read npm's version and `CFBundleShortVersionString`), re-checking after a branch update, confirming the merged commit matches the checked build, the base tag and commit count for the notes, `--latest` for a stable release, checking the docs deploy job succeeded, the milestone commands, and a new section 7 that checks the result. - **A `release` skill** in `.claude/skills/release/` (`/release X.Y.Z` in Claude Code) and `.agents/skills/release/`. It is a thin wrapper over `RELEASING.md`, like `self-review` is over the review standard. It adds five stops where it waits for a yes (branch, push and PR, a branch update, `gh release create`, docs and milestone), and merges only when the person asks, guarded by the checked head. - **`AGENTS.md`** points at `RELEASING.md` and the skill under "Where things are". - **What the 2.0.0 release turned up** (`c5ef531`): the bump diff allows the `build.electronLanguages` lines that `i18n:download` writes since #707; section 2 checks the macOS signature, notarization and staple, and the Windows installer's Authenticode signer; Buildkite's commit is confirmed by the person, because the build reports nothing to the pull request; the merge uses `--match-head-commit`; and section 7 checks the docs site's Download button from a new tab, because the button keeps the release it read for the tab's session. - **Third review round** (`43fdd1b`): only `X.Y.Z` and `X.Y.Z-beta.N` are accepted, so an rc is never published with `--latest`, and the stable notes base excludes every pre-release tag (`--exclude '*-*'`); section 3 checks the branch contains trunk before the merge and says to stop without tagging if the merged commit differs; a beta skips the docs deploy, as `docs.yml` and `CONTRIBUTING.md` intend; and section 2 notes that the pipeline asks for commit statuses that never reach the pull request. - **Fourth review round** (`72c3f69`): the skill runs the check after the merge whichever way the bump was merged, not only when it merged it; a mismatch there says how to recover (check the trunk build of the merged commit with section 2, then tag); and the milestone check lists open pull requests as well as issues. - **Copilot's review** (`ef49b34`): the Windows signature is verified by `Get-AuthenticodeSignature` on Windows, and the Mac `openssl` command is described as showing the signer only; `gh release create` names `--repo`; its paths are quoted. Not in it: downloading artifacts from Buildkite. The person downloads them; the skill checks them. ## How to test this Platforms: macOS for the artifact checks (they use `hdiutil` and `plutil`); anything else works on either. **Starting state:** this branch checked out, `npm ci` done, and a macOS build in `dist/` (`npm run dist`), or a `.dmg` downloaded from any Buildkite build. 1. From the repository root, run the section 1, item 1 checks in `RELEASING.md` with `X.Y.Z` = `2.1.0`. The two `rev-parse` lines match, and the other two commands print nothing. 2. Run the section 2 block against the `.dmg`. It prints `signed`; `accepted` with `source=Notarized Developer ID` and `origin` naming Automattic (an unsigned local build fails these three); `The validate action worked!`; `/node_modules`, `/package.json`, `/src`; a version starting with `11.`; then the build's version. Then run the Windows signature command against a Buildkite `.exe`. It prints a `subject` line naming `O=Automattic Inc.`. 3. In Claude Code, run `/release 2.1.0` and stop it at the first question. It runs the start checks and asks before creating `release/2.1.0`. **What must not have happened:** - After step 2, `git status` shows no change to `package.json`. An earlier draft used `asar extract-file`, which writes into the current directory. - The temporary mount point is gone after the block finishes. ## Risks and limitations - Review outcome: four rounds, 24 findings, all fixed, plus Copilot's 3, all fixed. CodeRabbit did not run (automatic review is off). - The skill has not driven a full release yet. 2.0.0 was released by hand from trunk's `RELEASING.md`, and what it turned up is folded in here (`c5ef531`). - The contents checks look inside the macOS build only. The Windows file is also checked for its signature; the Linux file is checked by name. ## Related Released with trunk's process: [v2.0.0](https://github.com/WordPress/contributor-toolkit/releases/tag/v2.0.0) (#711). --- <details> <summary>Design decisions and alternatives considered</summary> - **Procedure in `RELEASING.md`, behaviour in the skill.** The first draft put the commands in the skill. The review flagged that a person releasing by hand would never see them and that the two would drift, so they moved to `RELEASING.md`, and the skill keeps only what is agent-specific: the stops, leaving the merge to the person, and where the notes draft lives. - **No Buildkite API path.** Downloading through the API needs a token and the pipeline slug; asking the person to download into a named directory works today with nothing to configure. </details> <details> <summary>Review outcome (required — see AGENTS.md)</summary> Four rounds, 24 findings, all fixed. - **Review:** completed. Fresh Explore subagent with the diff and `code-review.instructions.md`. First round on head `a31b25d`, base `630253f` (`trunk`, no PR yet): 9 findings (6 fix here, 3 follow-up), all fixed in `5fb565e`, including `asar extract-file` overwriting `package.json` from the repo root, an unconditional milestone close that contradicted the beta rule, unfetched refs in the start checks, and procedure living only in the skill. Second round on `5fb565e`: 8 findings, all fixed in `fb32bc6`, including the docs check reading the previous run and not failing on a failed run, notes commands placed after the command that needs the notes, ambiguous step references, and missing milestone commands. `npm run lint` and `npm test` pass (2212 pass, 2 skipped). - **Since review:** `5fb565e → fb32bc6`: the second round's fixes only, not re-reviewed by a third pass. The new `gh` commands were run against this repository (milestone listing, the deploy-job query on the last docs dispatch) and the artifact commands against a local macOS build. `fb32bc6 → c5ef531`: the 2.0.0 findings, not reviewed. Every new command was run against the signed 2.0.0 files and printed what the text says, and the Windows command was also run against a copy with its signature entry cleared, where it fails with `not signed`. `npm run lint` passes. - **Third round** on `c5ef531`, base `trunk`, merge base `630253f`: 4 findings (2 fix here, 2 follow-up), all fixed in `43fdd1b`. One, that Buildkite posts commit statuses to the pull request, was checked against GitHub and did not hold: the 2.0.0 bump head `9df142b` has only CodeRabbit's status, so the fix is a note, not the suggested `gh api …/status` check. The new up-to-date check and the `--exclude '*-*'` base were run against this repository. `npm run lint` passes; `npm test` was not run, since only Markdown changed. - **Fourth round** on `43fdd1b`, base `trunk`, merge base `630253f`: fresh Explore subagent with the diff and `code-review.instructions.md`. 3 findings (3 fix here, 0 follow-up), all fixed in `72c3f69`: the skill tied the check after the merge only to the path where it merges itself, so a merge done by the person went straight to tagging; the stop on a mismatched merge left no way forward; and `gh issue list --milestone` misses open pull requests (`gh pr list --search 'milestone:…'` added, run against `v2.0.0`). `npm run lint` and `npm test` pass on `43fdd1b` (2212 pass, 2 skipped). - **Since review:** `43fdd1b → 72c3f69`: the fourth round's fixes only, Markdown in `RELEASING.md` and both `SKILL.md` copies, not re-reviewed. - **Copilot** on `43fdd1b`: 3 findings (3 fix here), all fixed in `ef49b34` and answered on each thread: the Mac `openssl` check read the certificates without verifying the signature, `gh release create` had no `--repo` despite "run from anywhere", and its paths were unquoted. `ef49b34` not reviewed. - **CodeRabbit:** not run. Its check reads `pass` but the message says automatic reviews are disabled; the pre-PR review above is the review of record, covering head `43fdd1b`. </details> <details> <summary>Screenshots or recording</summary> Nothing on screen changed; this is documentation and an agent skill. </details> 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
v2.0.0-beta.1shipped on 13 October. Ten commits have reached trunk since then (#667 to #707), and milestonev2.0.0has 8 closed issues and none open. This is a stable release: it takesreleases/latestfromv1.2.1.electron-buildernames the artifacts afterpackage.json, so the version has to move before the tag and artifacts exist.What changes
package.jsonandpackage-lock.jsonmove from2.0.0-beta.1to2.0.0. No dependency versions change.npm run i18n:downloadrefreshed the seven existing catalogs and addedlo,srandtr. None was removed, and no right-to-left locale was held back.build.electronLanguagesin line with the shipped catalogs, so it addedsrandtrthere.lohas no Chromium locale of its own.How to test this
Platforms: any for steps 1 to 3. Step 4 needs macOS for
Info.plistand Windows for the.exe. Steps 4 and 5 use the Buildkite build for the current head.Starting state: this branch checked out with
node_modulesinstalled. Run every command from the repository root.npm run lintis clean andnpm testpasses.node -e "console.log(require('./package.json').version)"prints2.0.0.python3 -c "import json;d=json.load(open('package-lock.json'));print(d['version'], d['packages']['']['version'])"prints2.0.0 2.0.0.wordpress-contributor-toolkit-2.0.0-*. Theapp.asarroot holds exactlynode_modules,package.jsonandsrc, with npm 11 undernode_modules/npmand no.codesigning. On macOS,CFBundleShortVersionStringreads2.0.0.What must not have happened: no dependency version may change.
git diff trunk -- . ':!src/languages'shows five changed lines: the three root version fields and the two newelectronLanguagesentries.Risks and limitations
None known. RELEASING.md still says to expect exactly three changed lines outside
src/languages/. Since #707 a release that adds a locale with a Chromium locale changeselectronLanguagestoo. #710 rewrites RELEASING.md and can update that line.Related
Milestone
v2.0.0. Release notes follow on the release.Review outcome (required — see AGENTS.md)
0 [fix here] · 0 [follow-up]. Automatic checks only, as in #681: this change has no logic to review.
9df142b/ base630253f(trunk).npm run lintpasses,npm testpasses (2214 tests, 0 failures, 2 skipped), both files are valid JSON, and the diff outsidesrc/languages/is the three root version fields plus the twoelectronLanguagesentries. Outcome: nothing to fix.🤖 Generated with Claude Code