Merge pull request #62 from ochenstarik-ui/codex/release-alpha20

release: prepare v0.1.0-alpha.20

.github/workflows/linux-release.yml

@@ -2,6 +2,11 @@ name: Release pipeline
 
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to rehearse (for example v0.1.0-alpha.20)'
+        required: false
+        type: string
   push:
     tags:
       - 'v*'
@@ -40,6 +45,8 @@ jobs:
 
       - name: Package bootstrap
         shell: bash
+        env:
+          REHEARSAL_TAG: ${{ inputs.tag }}
         run: |
           set -Eeuo pipefail
           DIST_DIR=dist
@@ -47,10 +54,19 @@ jobs:
           install -m 0755 deploy/ochenstarik-server-monitor-manager.sh "$DIST_DIR/ochenstarik-server-monitor-manager.sh"
           install -m 0755 deploy/smm-setup.sh "$DIST_DIR/smm-setup.sh"
           
-          # Substitute PROGRAM_VERSION from tag
+          # A branch rehearsal with an explicit tag must exercise the same
+          # version-consistency gate as an immutable tag build.
+          RELEASE_TAG=""
           if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            sed -i "s/^PROGRAM_VERSION=.*$/PROGRAM_VERSION=\"${GITHUB_REF_NAME}\"/" "$DIST_DIR/ochenstarik-server-monitor-manager.sh"
-            grep -Fq "readonly DEFAULT_RELEASE_TAG=\"${GITHUB_REF_NAME}\"" "$DIST_DIR/smm-setup.sh"
+            RELEASE_TAG="${GITHUB_REF_NAME}"
+          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "$REHEARSAL_TAG" ]]; then
+            RELEASE_TAG="$REHEARSAL_TAG"
+          fi
+          if [[ -n "$RELEASE_TAG" ]]; then
+            [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] \
+              || { printf 'Invalid release tag: %s\n' "$RELEASE_TAG" >&2; exit 1; }
+            sed -i "s/^PROGRAM_VERSION=.*$/PROGRAM_VERSION=\"${RELEASE_TAG}\"/" "$DIST_DIR/ochenstarik-server-monitor-manager.sh"
+            grep -Fq "readonly DEFAULT_RELEASE_TAG=\"${RELEASE_TAG}\"" "$DIST_DIR/smm-setup.sh"
           fi
           
           (
@@ -86,9 +102,13 @@ jobs:
       - name: Set Version
         id: version
         shell: bash
+        env:
+          REHEARSAL_TAG: ${{ inputs.tag }}
         run: |
           if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
             VERSION="${GITHUB_REF_NAME#v}"
+          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "$REHEARSAL_TAG" ]]; then
+            VERSION="${REHEARSAL_TAG#v}"
           else
             VERSION="0.2.0-dev"
           fi
@@ -176,9 +196,13 @@ jobs:
       - name: Set Version
         id: version
         shell: bash
+        env:
+          REHEARSAL_TAG: ${{ inputs.tag }}
         run: |
           if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
             VERSION="${GITHUB_REF_NAME#v}"
+          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "$REHEARSAL_TAG" ]]; then
+            VERSION="${REHEARSAL_TAG#v}"
           else
             VERSION="0.2.0-dev"
           fi
@@ -235,6 +259,8 @@ jobs:
 
       - name: Generate Manifest v2
         shell: bash
+        env:
+          REHEARSAL_TAG: ${{ inputs.tag }}
         run: |
           set -Eeuo pipefail
 
@@ -248,8 +274,11 @@ jobs:
           )
           
           # Version fallback for non-tag runs
-          VERSION="${GITHUB_REF_NAME}"
-          if [[ ! "${GITHUB_REF}" == refs/tags/* ]]; then
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF_NAME}"
+          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "$REHEARSAL_TAG" ]]; then
+            VERSION="$REHEARSAL_TAG"
+          else
             VERSION="0.0.0-dev"
           fi
           

.github/workflows/windows-build.yml

@@ -40,7 +40,7 @@ jobs:
 
       - name: Test Desktop security (live release)
         env:
-          SMM_TEST_RELEASE_TAG: v0.1.0-alpha.18
+          SMM_TEST_RELEASE_TAG: ${{ vars.SMM_TEST_RELEASE_TAG || 'v0.1.0-alpha.20' }}
         run: dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release -p:RestoreLockedMode=true --filter Category=LiveRelease
 
       - name: Build test-signed MSIX installer

deploy/smm-setup.sh

@@ -3,7 +3,7 @@ set -Eeuo pipefail
 IFS=$'\n\t'
 
 readonly PROGRAM_NAME="smm-setup"
-readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"
+readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.20"
 readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager"
 readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh"
 
@@ -34,7 +34,7 @@ asset. Use -- before a command to force pass-through. Common commands:
   backup-create | backup-restore | version
 
 Environment overrides:
-  SMM_TAG         Release tag (default: v0.1.0-alpha.18)
+  SMM_TAG         Release tag (default: v0.1.0-alpha.20)
   SMM_REPOSITORY  GitHub repository (default: ochenstarik-ui/server-monitor-manager)
   SMM_CACHE_DIR   Verified-download cache directory
 USAGE

docs/linux-bootstrap.md

@@ -6,11 +6,11 @@ Server Monitor Manager устанавливает Control (Hub) и Agent (Node)
 
 ## Быстрая установка
 
-Скачайте и проверьте convenience installer из `v0.1.0-alpha.18`:
+Скачайте и проверьте convenience installer из `v0.1.0-alpha.20`:
 
 ```bash
-curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh
-curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh.sha256
+curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.20/smm-setup.sh
+curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.20/smm-setup.sh.sha256
 sha256sum -c smm-setup.sh.sha256
 chmod 700 smm-setup.sh
 ```

docs/release-policy.md

@@ -20,5 +20,6 @@ Known release history:
 - `v0.1.0-alpha.16` clears the acceptance shell's command hash after removing its test-provisioned cosign. Its automatic verification proved clean-host Hub installation, but the convenience installer wrote the bootstrap checksum success line to stdout before the machine-readable `SMMNODE2` enrollment code. Node installation therefore rejected the contaminated value. The immutable release and failed verification remain as evidence; stdout isolation is corrected in the next version.
 - `v0.1.0-alpha.17` keeps checksum verification fail-closed while suppressing its success line, so pass-through commands such as `node-code` return only their machine-readable bootstrap output. Its automatic verification completed the clean-host Hub and Node installation, then the negative-test harness stopped while creating a wrong-identity signature because cosign v3 requires an explicit bundle or legacy detached-output mode. The immutable release and failed harness run remain as evidence; the negative test is corrected in the next version.
 - `v0.1.0-alpha.18` makes the wrong-identity negative test select cosign v3's explicit detached-output mode, matching the production consumer's detached signature and certificate contract. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification.
+- `v0.1.0-alpha.19` exists as a tag, but its Release pipeline failed when the packaged convenience installer's `DEFAULT_RELEASE_TAG` did not match the immutable tag. No GitHub Release was published. The version number is burned and must not be moved, deleted, recreated, or reused.
 
 Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green.

tests/bootstrap/test-release-contract.sh

@@ -11,6 +11,7 @@ windows_workflow="$root/.github/workflows/windows-release.yml"
 policy="$root/docs/release-policy.md"
 installer_contract="$root/docs/installer-contract.md"
 manifest_test="$root/tests/bootstrap/test-manifest-verification.sh"
+version_consistency_test="$root/tests/bootstrap/test-release-version-consistency.sh"
 v1_fixture="$root/tests/fixtures/alpha8-v1-release"
 
 [[ -s "$setup" ]] || {
@@ -18,7 +19,12 @@ v1_fixture="$root/tests/fixtures/alpha8-v1-release"
     exit 1
 }
 bash -n "$setup"
-grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"' "$setup"
+grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.20"' "$setup"
+bash -n "$version_consistency_test"
+if command -v shellcheck >/dev/null 2>&1; then
+    shellcheck --severity=error "$version_consistency_test"
+fi
+bash "$version_consistency_test"
 grep -Fq 'install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]' "$setup"
 grep -Fxq '  install-node' "$setup"
 if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then
@@ -63,6 +69,7 @@ grep -Fq 'v0.1.0-alpha.15' "$policy"
 grep -Fq 'v0.1.0-alpha.16' "$policy"
 grep -Fq 'v0.1.0-alpha.17' "$policy"
 grep -Fq 'v0.1.0-alpha.18' "$policy"
+grep -Fq 'v0.1.0-alpha.19' "$policy"
 grep -Fq 'hash -r' "$root/tests/release-verification/run-positive-installation.sh"
 grep -Fq -- '--use-signing-config=false --new-bundle-format=false' \
     "$root/tests/release-verification/run-negative-tests.sh"
@@ -193,8 +200,8 @@ chmod +x "$work/bin/uname"
 
 HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output"
 grep -Fq 'INNER_ARGS=version ' "$work/output"
-grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh' "$work/urls"
-grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
+grep -Fq '/releases/download/v0.1.0-alpha.20/ochenstarik-server-monitor-manager.sh' "$work/urls"
+grep -Fq '/releases/download/v0.1.0-alpha.20/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
 
 node_code="$(HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" node-code fixture-node)"
 [[ "$node_code" == 'SMMNODE1.fixture' ]] || {

tests/bootstrap/test-release-version-consistency.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+IFS=$'\n\t'
+
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
+setup="$root/deploy/smm-setup.sh"
+linux_docs="$root/docs/linux-bootstrap.md"
+windows_workflow="$root/.github/workflows/windows-build.yml"
+release_workflow="$root/.github/workflows/linux-release.yml"
+
+default_tag="$(sed -n 's/^readonly DEFAULT_RELEASE_TAG="\([^"]*\)"$/\1/p' "$setup")"
+[[ "$default_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] || {
+    printf 'invalid or missing DEFAULT_RELEASE_TAG: %s\n' "$default_tag" >&2
+    exit 1
+}
+
+grep -Fq "SMM_TAG         Release tag (default: $default_tag)" "$setup" || {
+    printf '%s\n' 'smm-setup help default does not match DEFAULT_RELEASE_TAG' >&2
+    exit 1
+}
+
+windows_tag="$(
+    grep -E '^[[:space:]]*SMM_TEST_RELEASE_TAG:' "$windows_workflow" \
+        | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?' \
+        | sort -u
+)"
+[[ "$windows_tag" == "$default_tag" ]] || {
+    printf 'Windows live-release tag %s does not match %s\n' "$windows_tag" "$default_tag" >&2
+    exit 1
+}
+
+mapfile -t documented_tags < <(
+    grep -Eo 'v0\.1\.0-alpha\.[0-9]+' "$linux_docs" | sort -u
+)
+[[ ${#documented_tags[@]} -gt 0 ]] || {
+    printf '%s\n' 'Linux bootstrap documentation has no release download tag' >&2
+    exit 1
+}
+for documented_tag in "${documented_tags[@]}"; do
+    [[ "$documented_tag" == "$default_tag" ]] || {
+        printf 'Documented release tag %s does not match %s\n' "$documented_tag" "$default_tag" >&2
+        exit 1
+    }
+done
+
+grep -Fq 'REHEARSAL_TAG: ${{ inputs.tag }}' "$release_workflow"
+[[ "$(grep -Fc 'REHEARSAL_TAG: ${{ inputs.tag }}' "$release_workflow")" -eq 4 ]]
+grep -Fq 'grep -Fq "readonly DEFAULT_RELEASE_TAG=\"${RELEASE_TAG}\""' "$release_workflow"
+
+printf 'RELEASE_VERSION_CONSISTENCY=PASS tag=%s\n' "$default_tag"