diff --git a/.github/workflows/axolotl-compatibility.yml b/.github/workflows/axolotl-compatibility.yml index d28072c..5ff52bd 100644 --- a/.github/workflows/axolotl-compatibility.yml +++ b/.github/workflows/axolotl-compatibility.yml @@ -103,7 +103,7 @@ jobs: - name: Build and analyze DevTools-owned example PHAR with the pinned stable builder if: steps.release.outputs.candidate == 'true' id: build - uses: AxolotlBucketLabs/DevTools@v4.0.3 + uses: AxolotlBucketLabs/DevTools@v4.0.4 with: project: examples/HelloShared virions: examples diff --git a/docs/ecosystem.json b/docs/ecosystem.json index 257a293..160df10 100644 --- a/docs/ecosystem.json +++ b/docs/ecosystem.json @@ -34,8 +34,8 @@ ] }, "devtools": { - "stable_version": "v4.0.3", - "stable_commit": "106547e8b142a3f6a65a4b3c66d1ace477e56f10", + "stable_version": "v4.0.4", + "stable_commit": "cd05e444a26b3c63720b443961b3646e22307f56", "reference_policy": "Use @v4 for compatible v4 updates or @latest to follow stable releases across major versions. Exact release tags and commit pins are also supported. This inventory records the current stable release, not each project's selected pin." }, "summary": { diff --git a/docs/ecosystem.md b/docs/ecosystem.md index 3db3db9..86433f2 100644 --- a/docs/ecosystem.md +++ b/docs/ecosystem.md @@ -2,7 +2,7 @@ This page gives a short human-readable summary of public projects whose default-branch workflows reference DevTools. The complete inventory and its counts are stored in [`ecosystem.json`](ecosystem.json). The data contract is described by [`ecosystem.schema.json`](ecosystem.schema.json). -The latest stable release represented by this inventory is DevTools `v4.0.3`, at commit `106547e8b142a3f6a65a4b3c66d1ace477e56f10`. Use `@v4` for compatible v4 updates or `@latest` to follow stable releases across major versions. Exact release tags and commit pins are also supported. This inventory records the current stable release, not each project's selected pin. +The latest stable release represented by this inventory is DevTools `v4.0.4`, at commit `cd05e444a26b3c63720b443961b3646e22307f56`. Use `@v4` for compatible v4 updates or `@latest` to follow stable releases across major versions. Exact release tags and commit pins are also supported. This inventory records the current stable release, not each project's selected pin. ## Inventory diff --git a/docs/github-actions.md b/docs/github-actions.md index b4e82a1..ee3170c 100644 --- a/docs/github-actions.md +++ b/docs/github-actions.md @@ -2,7 +2,7 @@ The composite action calls `bin/devtools.php build --json`, using the same builder as the CLI and server command. It accepts `type: plugin` (default) or `type: virion`, verifies the reported PHAR SHA-256 and exposes the actual path from that result. PHPStan and Composer dependency preparation are opt-in for plugin builds. Virion builds use `phpstan: off` because the action's PHPStan helper is plugin-oriented. A successful build verifies packaging. It does not prove an Axolotl-PM runtime boot. -These interfaces are available in the `v4.0.3` release. Most repositories should use the maintained `v4` channel: `AxolotlBucketLabs/DevTools@v4` for the composite action and `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` or `build-virion.yml@v4` for reusable workflows. The `latest` channel is also available for repositories that intentionally want every stable release, including future major versions. Use `AxolotlBucketLabs/DevTools@latest` or the corresponding reusable workflow reference. Use `@v4.0.3` when a repository should stay on one release, or a full commit SHA for a strict reproducible pin. The called workflow checks out its builder from the resolved reference using the current job's workflow identity. Installing DevTools does not publish a release. +These interfaces are available in the `v4.0.4` release. Most repositories should use the maintained `v4` channel: `AxolotlBucketLabs/DevTools@v4` for the composite action and `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` or `build-virion.yml@v4` for reusable workflows. The `latest` channel is also available for repositories that intentionally want every stable release, including future major versions. Use `AxolotlBucketLabs/DevTools@latest` or the corresponding reusable workflow reference. Use `@v4.0.4` when a repository should stay on one release, or a full commit SHA for a strict reproducible pin. The called workflow checks out its builder from the resolved reference using the current job's workflow identity. Installing DevTools does not publish a release. ## Short build workflow @@ -185,24 +185,24 @@ DevTools moves `latest` only to a validated stable release. It may move from v4 Use an exact release when a repository needs controlled upgrades. ```yaml -uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4.0.3 +uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4.0.4 ``` Use a full commit SHA for strict reproducibility or a supply-chain policy. Resolve the commit behind the reviewed release tag and keep the version in a comment. ```sh -git ls-remote https://github.com/AxolotlBucketLabs/DevTools.git 'refs/tags/v4.0.3^{}' +git ls-remote https://github.com/AxolotlBucketLabs/DevTools.git 'refs/tags/v4.0.4^{}' ``` ```yaml -uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@106547e8b142a3f6a65a4b3c66d1ace477e56f10 # v4.0.3 +uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@cd05e444a26b3c63720b443961b3646e22307f56 # v4.0.4 ``` The called job reads its own `workflow_sha` and `workflow_repository`, checks out that revision, and verifies the checked-out HEAD and CLI contract before building. The same rule applies to release verification. The workflow contract no longer accepts the removed `devtools-ref` input. Remove it when migrating a v1 caller. GitHub's workflow identity context is available on GitHub.com. These reusable workflows are not supported on GitHub Enterprise Server without that context. ## Migrate from v1 -Update the reusable workflow reference to `@v4` and remove legacy inputs that the current workflow does not declare. Use `@latest` only if the repository intentionally accepts major upgrades. Use `@v4.0.3` or a full SHA when the repository requires a controlled or strict pin. +Update the reusable workflow reference to `@v4` and remove legacy inputs that the current workflow does not declare. Use `@latest` only if the repository intentionally accepts major upgrades. Use `@v4.0.4` or a full SHA when the repository requires a controlled or strict pin. ```diff with: diff --git a/tests/Validation/RepositoryMetadataTest.php b/tests/Validation/RepositoryMetadataTest.php index 9cf1963..94cf7ee 100644 --- a/tests/Validation/RepositoryMetadataTest.php +++ b/tests/Validation/RepositoryMetadataTest.php @@ -20,7 +20,7 @@ final class RepositoryMetadataTest extends TestCase { private const VERSION = '4.0.4'; - private const COMPATIBILITY_BUILDER_VERSION = '4.0.3'; + private const COMPATIBILITY_BUILDER_VERSION = '4.0.4'; private const PHP_ACTION_VERSION = '1.0.0'; public function test_release_version_is_synchronized() : void