RUST-CI-009 - Certify a Beta 3 candidate without publishing #142

Activity

1. itlezy

   added this to the rust-v0.1.0-beta.3 milestone on Oct 22, 2026
2. itlezy

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   rustPull requests that update rust codePull requests that update rust code

   on Oct 22, 2026
3. itlezy commented on Oct 22, 2026

   

   itlezy

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Non-publishing release rehearsal completed successfully.

   • Rust implementation: ci: retain nonpublishing release candidates #143
   • Successful workflow run: https://github.com/emulebb/emulebb-rust/actions/runs/39796808727
   • Source: 9e9320e69f070c62d04d1170a5a8997eba7387e2
   • Result: all six native packages, OCI/security evidence, and candidate assembly succeeded.
   • Retained manifest: 29 hashed evidence files plus the manifest; all recorded revisions, sizes, SHA-256 values, native checksums, image-security checksums, and OCI digest independently matched.
   • Publication status: GHCR, GitHub prerelease, nightly channel, and retention jobs were skipped; no tag or Release was created.
   • Durable evidence update: docs: record Beta 3 release rehearsal emulebb-tooling#50

   This was deliberately a 0.1.0-beta.2 machinery rehearsal. It is not the selected Beta 3 candidate, does not complete RUST-CI-006 or packaged lifecycle certification, and leaves this issue and the milestone open for further review iterations.
4. itlezy commented on Oct 22, 2026

   

   itlezy

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Packaged-lifecycle rehearsal is now green and durably recorded.

   • emulebb-build-tests PR #16 fixed AppImage execute-bit restoration and stopped temporary-root cleanup from suppressing smoke failures.
   • Rust PR #145 pinned the merged harness at fdabef50aaacbb4818dfa8b8561a9441e76afc70.
   • Exact Rust source 45b4d40005472315b6e675515f725c95565c3384 passed push Required CI and Required CodeQL.
   • Nonpublishing Release run 39832416413 passed all six native package jobs, all six downstream packaged-lifecycle jobs, multiarch image/security assembly, and candidate assembly.
   • Manifest format 2 retained six report digests covering eight native assets. Both Linux architectures cover DEB and AppImage. Every result completed the direct local 262144-byte ED2K transfer with public discovery disabled, exact delivered SHA-256, incoming-directory delivery, and two graceful shutdowns.
   • All four publish/channel/retention jobs were skipped; no tag, release, image, version bump, or milestone change occurred.
   • Durable evidence merged in tooling PR #51.

   This proves the hosted package-lifecycle machinery only. RUST-CI-009 remains open: no acceptance checkbox is being closed until an explicit Beta 3 candidate is selected and RUST-CI-006 is complete against that exact revision.
5. itlezy commented on Oct 23, 2026

   

   itlezy

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Beta 3 scope stabilization completed for the current working baseline.

   • Working Rust baseline: 45b4d40005472315b6e675515f725c95565c3384; local main and origin/main were clean and synchronized.
   • Required source checks remain green: Required CI and Required CodeQL.
   • The successful nonpublishing package/lifecycle rehearsal remains run 39832416413.
   • Dependabot PRs #134, #135, and #139 are explicitly deferred and remain unmerged for this stabilization pass.
   • Code scanning moved from 17 open findings to zero: 14 false positives (13 trusted-workflow trigger/permission-boundary findings plus the protocol-mandated eD2K MD5/RC4 finding), one test-only finding, and two accepted RUST-BUG-109 API-key onboarding/session-storage tradeoffs. Each dismissal carries its category-specific rationale.
   • Dependabot vulnerability alerts: zero. Secret-scanning alerts: zero.
   • No product source, policy, OpenAPI, WebUI, packaging, dependency lock, or tracked repository file changed.

   This records a working stabilization baseline only. No Beta 3 candidate was selected, and no version bump, tag, GitHub Release, image publication, or milestone change was performed. The next gate is support/reference-client preflight followed by RUST-CI-006 against one explicitly selected immutable revision.