🚀 - 3.10.0 - Release v3.10.0 verification setup and compact comment workflows #667

Release Type

Minor

Release Version

3.10.0

Changelog

• Centralize native comment verification coordination in a versioned Copilot reusable workflow, keeping repository and generated callbacks compact while preserving same-job setup, native timeouts, exact workflow/Action version binding and cleanup. Preserve reviewed runner placement during upgrade, block unsupported custom bootstrap migration, and document Actions runner 2.336.0+ and reusable-workflow policy requirements (🔧🧑‍💻 - refactor centralize native comment verification in a reusable workflow #662, chore: centralize comment verification in one reusable workflow #663).

• Prepare repository verification dependencies with a native, repository-owned composite action. Execute the reviewed trusted-main snapshot before candidate verification, with isolated credentials and native post-step cleanup (✨ - Support repository owned verification setup hooks without editing generated workflows #647, feat: prepare repository verification with native composite actions #652).

• Generate .github/actions/copilot-verification-setup/action.yml only when absent, preserve existing consumer actions and their auxiliary files, and expose opt-in VERIFICATION_SETUP activation in the shared web/terminal assistant. Include the starter in npm and document staged upgrades and rollback (✨🧑‍💻 - Generate verification setup starter preserve consumer actions and expose wizard activation #656, feat(#656): generate verification setup actions and expose wizard activation #657).

• Improve unsupported stored-configuration recovery, actionable SDD ownership diagnostics, companion SDD case/acceptance consistency, and Bugbot finding mutation and duplicate reconciliation diagnostics (🐛🧑‍💻 - Improve diagnostics and recovery for unsupported PR configuration schemas #635, 🐛🧑‍💻 - Pre branch SDD ownership analysis fails without an actionable issue diagnostic or clarification card #636, 🐛🧑‍💻 - bug Bugbot persists a review then fails reconciliation with opaque provider.unavailable #646, 🐛🧑‍💻 - bug generated companion SDD publishes colliding case IDs and inconsistent acceptance mappings #653, 🐛🧑‍💻 - Bugbot reconciliation retains an orphan unknown finding alongside duplicate semantic reports #655; PRs fix: diagnose unsupported stored configuration with safe recovery #642, fix: publish actionable SDD ownership diagnostics #650, fix: retain actionable finding mutation diagnostics #651, fix(sdd): validate companion case and acceptance consistency #654, fix: Bugbot reconciliation retains an orphan unknown finding alongside duplicate semantic reports (#655) #658).

• Forward live merge-queue attestations through release/hotfix publication, stabilize hosted Windows permission-journal coverage, and keep bounded RepoWise analysis available on demand (🐛🧑‍💻 - bugfix intermittent hosted Windows permission journal test exceeds Jest timeout #577, 📝🧑‍💻 - Clarify deployment queue syntax and managed AGENTS.md hash scope #637, 🔧 - Run RepoWise only on demand to avoid CI bottlenecks #639, 🐛🧑‍💻 - Release and hotfix publication callbacks omit live merge queue attestations #643, 🔧🧑‍💻 - Optimize manual RepoWise analysis and complete bounded dead code and history scans #644; PRs fix: bugfix intermittent hosted Windows permission journal test exceeds Jest timeout (#577) #638, docs: clarify deployment queues and managed pointer hashes #640, chore: run RepoWise only on manual dispatch #641, chore: complete bounded manual RepoWise analysis #645, fix: forward live queue attestations on publication #649).

• Reject mutually incompatible proposed SDD file paths and distinguish literal configuration-marker mentions from real stored state, preserving existing supported records and human description text (release review release(3.10.0): promote to master #660).

• Restrict native verification request cleanup to requests created by the validated invocation; clarify the consumer hook versus Copilot coordinator scope (release review release(3.10.0): promote to master #664).

• Retain provider-based Cursor key minimization at the reusable workflow boundary and align the historical hook decision with the accepted central coordinator (release review release(3.10.0): promote to master #666).

Additional Context

The maintainer explicitly authorized preparing and publishing 3.10.0 after compact comment coordination, all current-head checks and complete review with no unresolved findings. Encapsulation issue #662/PR #663 is merged in develop. Earlier real review fixes are already on the canonical release line and must be retained.

This fresh unpublished attempt replaces #665 and promotion #666. Their immutable operation c8ac4e53-427a-471b-8ebb-c2577d7a9e7b and source d33064a remain unchanged for audit. That candidate passed CI and all three hosted platforms, but the final review identified two corrections to complete before freezing again: preserve Cursor provider gating on the secret passed into the reusable workflow, as well as on its existing initial step, and align the historical SDD decision paragraph with the explicitly supported central coordinator. No production merge, version tag or npm publication occurred.

Use the installed Action-owned release branch and official preparation, production PR, protected merge, npm trusted publication, GitHub Release, major Action ref and development reconciliation. Do not manually create/reset/force-push branches or tags, or rewrite prior durable operations. Wait for Action admission of the exact existing canonical ref before normal contributor commits. Freeze only the corrected validated candidate. Require all applicable current-head checks and complete review with no unresolved findings before any merge. Finally verify publication identity across accepted production SHA, package.json, immutable v3.10.0 tag, npm version/gitHead, GitHub Release and moving v3 ref; verify registry CLI, setup starter, reconciliation and issue completion.