Repository navigation
🚀 - 3.10.0 - Release v3.10.0 verification setup and validated onboarding #661
Description
Release Type
Minor
Release Version
3.10.0
Changelog
-
Centralize native comment verification coordination in a versioned Copilot reusable workflow, keeping repository and generated callbacks compact while preserving same-job setup, native timeouts, exact workflow/Action version binding and cleanup. Preserve reviewed runner placement during upgrade, block unsupported custom bootstrap migration, and document Actions runner 2.336.0+ and reusable-workflow policy requirements (🔧🧑💻 - refactor centralize native comment verification in a reusable workflow #662, chore: centralize comment verification in one reusable workflow #663).
-
Prepare repository verification dependencies with a native, repository-owned composite action. Execute the reviewed trusted-main snapshot before candidate verification, with isolated credentials and native post-step cleanup (✨ - Support repository owned verification setup hooks without editing generated workflows #647, feat: prepare repository verification with native composite actions #652).
-
Generate
.github/actions/copilot-verification-setup/action.ymlonly when absent, preserve existing consumer actions and their auxiliary files, and expose opt-inVERIFICATION_SETUPactivation in the shared web/terminal assistant. Include the starter in npm and document staged upgrades and rollback (✨🧑💻 - Generate verification setup starter preserve consumer actions and expose wizard activation #656, feat(#656): generate verification setup actions and expose wizard activation #657). -
Improve unsupported stored-configuration recovery, actionable SDD ownership diagnostics, companion SDD case/acceptance consistency, and Bugbot finding mutation and duplicate reconciliation diagnostics (🐛🧑💻 - Improve diagnostics and recovery for unsupported PR configuration schemas #635, 🐛🧑💻 - Pre branch SDD ownership analysis fails without an actionable issue diagnostic or clarification card #636, 🐛🧑💻 - bug Bugbot persists a review then fails reconciliation with opaque provider.unavailable #646, 🐛🧑💻 - bug generated companion SDD publishes colliding case IDs and inconsistent acceptance mappings #653, 🐛🧑💻 - Bugbot reconciliation retains an orphan unknown finding alongside duplicate semantic reports #655; PRs fix: diagnose unsupported stored configuration with safe recovery #642, fix: publish actionable SDD ownership diagnostics #650, fix: retain actionable finding mutation diagnostics #651, fix(sdd): validate companion case and acceptance consistency #654, fix: Bugbot reconciliation retains an orphan unknown finding alongside duplicate semantic reports (#655) #658).
-
Forward live merge-queue attestations through release/hotfix publication, stabilize hosted Windows permission-journal coverage, and keep bounded RepoWise analysis available on demand (🐛🧑💻 - bugfix intermittent hosted Windows permission journal test exceeds Jest timeout #577, 📝🧑💻 - Clarify deployment queue syntax and managed AGENTS.md hash scope #637, 🔧 - Run RepoWise only on demand to avoid CI bottlenecks #639, 🐛🧑💻 - Release and hotfix publication callbacks omit live merge queue attestations #643, 🔧🧑💻 - Optimize manual RepoWise analysis and complete bounded dead code and history scans #644; PRs fix: bugfix intermittent hosted Windows permission journal test exceeds Jest timeout (#577) #638, docs: clarify deployment queues and managed pointer hashes #640, chore: run RepoWise only on manual dispatch #641, chore: complete bounded manual RepoWise analysis #645, fix: forward live queue attestations on publication #649).
-
Reject mutually incompatible proposed SDD file paths and distinguish literal configuration-marker mentions from real stored state, preserving existing supported records and human description text (release review release(3.10.0): promote to master #660).
Additional Context
The maintainer explicitly authorized preparing and publishing the next minor release, then reporting the published version and exact upgrade steps for repositories already configured with Copilot. The latest verified npm/GitHub version is 3.9.3; this operation targets 3.10.0. No active release issue was found.
Cut the release from the Action-owned snapshot of develop. The development tip inspected before admission was c055c6c9fe31f3e2189017772a281629d3989968, containing verification setup PRs #652 and #657 and the companion consistency and reconciliation fixes #654 and #658. Preserve the frozen origin recorded by the Action.
Use the installed release preparation, protected production promotion, npm trusted publication, GitHub Release, major Action reference update, and development reconciliation flow. Wait for the current-head checks and complete review with no unresolved findings before any merge. Do not bypass branch rules or manually create release branches, tags, or publication artifacts.
Before declaring completion, verify that package.json, immutable v3.10.0 tag, npm @vypdev/copilot@3.10.0 gitHead, GitHub Release, and the updated v3 Action ref identify the accepted production commit; verify development reconciliation and issue completion. Verify the published CLI and setup starter from the registry package. Keep verification setup disabled during consumer preparation, customize the starter on trusted MAIN_BRANCH before enabling it, and document updating both workflow YAML and any pinned Action references.
This is a fresh unpublished attempt replacing issue #659 and promotion PR #660. The former operation remains closed with its immutable source SHA and review evidence retained. No accepted production commit, version tag or npm publication existed for that attempt. The Action may expose the existing prepared release line or recreate its canonical branch; contributor fixes will be pushed normally only after the new issue reports branch readiness, before adding deploy. Freeze the corrected, validated source during this new preparation.
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
[-]Release v3.10.0 verification setup and validated onboarding[/-][+]🚀 - 3.10.0 - Release v3.10.0 verification setup and validated onboarding[/+]fix(release): validate proposed paths and literal configuration markers
efraespada commentedon Oct 21, 2026
The Action admitted this release issue and exposed the existing canonical
release/3.10.0branch. Before starting deployment, I pushed the normal fast-forward correction commit9e0ee54bto that exact ref.This addresses both actionable findings from the superseded, unpublished promotion #660: incompatible proposed SDD ancestor/descendant paths and literal configuration-marker mentions incorrectly treated as damaged stored state. Supported complete legacy records remain readable and ambiguous real state still fails closed. The two other findings were resolved with runner lifecycle and credential-free command environment evidence in #660; the relevant contract clarifications and an adversarial environment regression are included here.
Local validation of the corrected candidate passed: 709 test suites, 11,789 passing tests (35 skipped), the full coverage gates, typecheck, lint, specification and documentation validation, regenerated catalog, build, reproducible build validation, npm package validation and isolated package smoke. There are 28 new focused regression cases. The knowledge graph was updated locally; generated graph files are not part of the release change.
The next deployment preparation must freeze this corrected candidate in a new operation. No tag, npm package, production merge or release was published by #659/#660. That superseded operation and its source identity remain unchanged for audit. Publication and final reconciliation will use the repository's official workflow, with current-head checks and complete review required before merge.
efraespada commentedon Oct 21, 2026
The maintainer requested that the native verification coordination be encapsulated before publishing 3.10.0, so repository and installed setup callbacks stay simple while preserving behavior. I removed
deploybefore any promotion PR was opened for this attempt. No publication is authorized until this change has passed the full checks and has no unresolved findings.The runtime contract (trusted setup source, candidate identity, one-use continuations, fresh verification environments, no provider/PAT forwarding to setup, fail-closed verification and reverse native post cleanup) remains mandatory. One provider constraint is under explicit design review: GitHub's current composite action schema does not accept
timeout-minuteson internal steps. Encapsulation must not silently claim the same native per-setup cancellation if it no longer exists. The maintainer is choosing the supported encapsulation boundary with this tradeoff disclosed.Primary runner evidence: https://github.com/actions/runner/blob/main/src/Runner.Worker/action_yaml.json and https://github.com/actions/runner/blob/main/docs/adrs/1144-composite-actions.md.
2 remaining items
efraespada commentedon Oct 21, 2026
/copilot sync-branch --from develop --no-agent
vypbot commentedon Oct 21, 2026
Issue closed: synchronization recommendation retired
No branch synchronization is required for this closed issue.
The previous recommendation is historical. Issue closure does not certify that the branches are synchronized.
vypbot commentedon Oct 21, 2026
Branch synchronized
developwas merged intorelease/3.10.0and pushed as4d7906e639a7867563e966c62e4ec9b79e17b89c.6 verification checks passed.
vypbot commentedon Oct 21, 2026
❌ Release
3.10.0Action required
Managed promotion PR #664 was closed without merge.. Retry after correcting the cause.
What Copilot protected
Production updated: No. Package status: not published.
Progress
develop@f5f462bmasterdevelopflowchart LR D[Source snapshot] --> R[Version prepared] R --> P[Production PR] P --> A[Accepted in production] A --> N[Package and release] N --> B[Development reconciliation] B --> C[Complete]prepared -> production PR -> accepted -> published -> reconciled -> complete
Current transition
release/3.10.0masterLinks
Release control center · release/3.10.0 branch · f5f462b origin commit · 4d7906e prepared commit · Compare changes · Promotion PR #664
Technical details
63381e09-9a3d-440d-aa28-a8efcaa85308production-lineageauto-merge4d7906e639a7867563e966c62e4ec9b79e17b89cpendingefraespada commentedon Oct 22, 2026
Superseded by a fresh unpublished attempt after promotion #664 review. The frozen operation and source identity remain intact; no production merge, release tag or npm publication occurred. The new candidate will correct ownership-safe request cleanup and the SDD scope clarification before official preparation.