Thomas Vincent
13adf317c0
* chore: resolve concurrent CHANGELOG appends with a union merge Every PR lands on the same two anchors, so merging one reliably conflicts the others on CHANGELOG alone. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> (cherry picked from commit6bc8e63ecb) * feat(changelog): take entries as fragment files instead of CHANGELOG edits Every pull request edited one of two lines, so merging one conflicted the rest. A file per change gives concurrent PRs nothing to collide over. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> (cherry picked from commita8a0bfa29a) * chore(security): drop line numbers from the tracked sink baselines Both verifiers already strip the line before comparing, so the tracked numbers carried no signal and rewrote 212 lines of baseline on any edit that shifted code, conflicting every open pull request. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> (cherry picked from commitccfd3d374b) * fix(ci): rebase stale pull request branches instead of merging them A merge update adds a commit per run, so branches accumulate snapshots of old develop and re-conflict on every shared file they carry. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> (cherry picked from commite9e33c77cd) * test: match the escaping call rather than the exact source line The literal assertions here required the uncast form while PhpBinaryPathNullCoercionTest required the cast, so the two could not both pass and whichever landed second broke the other. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> (cherry picked from commit98cfc84756) * fix(changelog): handle security entries in fragments and validation Review caught the missing type. Security entries also take GHSA identifiers and open a release section ahead of issue and feature entries, none of which the first pass handled. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: require Composer-managed dependencies Prevent agents from committing third-party package trees and require composer.json plus composer.lock updates instead. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
1.2 KiB
CHANGELOG fragments
Add a file here instead of editing CHANGELOG directly. Every pull request
that edits CHANGELOG lands on one of two lines, the top of the issue block or
the end of the feature block, so merging one pull request conflicts the rest.
A fragment is a new file per change, which nothing else touches.
Name the file after the issue or pull request number. Security entries take either a number or a GHSA identifier:
changelog.d/7634.feature
changelog.d/7692.issue
changelog.d/7476.security
changelog.d/GHSA-wpjq-m269-mghj.security
Put the description on a single line, with no -feature# or -issue# prefix:
Add indexes for host-template and session lookup queries
The release fold turns that into:
-feature#7634: Add indexes for host-template and session lookup queries
A release section runs security, then issue, then feature. Security and issue entries are newest first, features oldest first, and the fold places each entry accordingly.
tests in CI validate fragment names and contents. Run the fold when cutting a
release, which rewrites CHANGELOG and removes the fragments:
python3 .github/scripts/fold-changelog.py
Use --check to see what would be folded without writing anything.