diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a91173b..810d740 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,7 +24,7 @@ jobs: fetch-depth: 0 - name: Install MoonBit - uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22 + uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23 with: version: 0.10.6+62c2592d1 @@ -141,7 +141,7 @@ jobs: uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 - name: Install MoonBit - uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22 + uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23 with: version: 0.10.6+62c2592d1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 191d4a4..4639aa1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,7 +18,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22 + - uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23 with: version: 0.10.6+62c2592d1 - name: Ensure MoonX entry point @@ -35,8 +35,6 @@ jobs: include: - os: ubuntu-latest platform: linux-x86_64 - - os: macos-15-intel - platform: macos-x86_64 - os: macos-latest platform: macos-aarch64 - os: windows-latest @@ -50,13 +48,15 @@ jobs: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 with: persist-credentials: false - - uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22 + - uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23 with: version: 0.10.6+62c2592d1 - name: Ensure MoonX entry point shell: bash run: ./tools/release/ensure_moonx.sh - run: moon update + - name: Install exact dependencies + run: moon check --target all --warn-list +73 - name: Build and verify shell: bash run: | @@ -93,12 +93,14 @@ jobs: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 with: persist-credentials: false - - uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22 + - uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23 with: version: 0.10.6+62c2592d1 - name: Ensure MoonX entry point run: ./tools/release/ensure_moonx.sh - run: moon update + - name: Install exact dependencies + run: moon check --target all --warn-list +73 - name: Build wasm1 staging asset run: MOONJUST_REQUIRE_CLEAN=1 MOONJUST_RELEASE_PLATFORM=linux-x86_64 ./tools/release/build_artifacts.sh - name: Verify staging MoonX protocol diff --git a/compat/phase-11.toml b/compat/phase-11.toml index 491c2ca..f4101e0 100644 --- a/compat/phase-11.toml +++ b/compat/phase-11.toml @@ -10,6 +10,7 @@ audit = "docs/PHASE_0_11_AUDIT.md" mooncakes = "complete module metadata, source package validation, documented public facade and exact moonx executable coordinate" policy = "deny, inspect, CI and execute policies with real capability-denial and allow-path smoke tests" artifacts = "release-mode Linux, macOS and Windows Native executables plus linear-memory wasm1, SHA-256 checksums and clean extraction smoke tests" +native_matrix = "linux-x86_64, macos-aarch64 and windows-x86_64; macos-x86_64 is excluded because the official MoonBit installer removed Intel macOS toolchain distribution" supply_chain = "CycloneDX SBOM, SLSA-compatible provenance predicate, checksums and GitHub OIDC artifact attestations bound to commit and toolchain" upgrade = "cold source-package install, previous-release replacement, corpus execution and byte-preserving rollback without shared project build cache" publication = "repository automation prepares and attests candidates only; formal Mooncakes publication, tags and GitHub Releases are maintainer-only" diff --git a/docs/PHASE_0_11_AUDIT.md b/docs/PHASE_0_11_AUDIT.md index 5abe7d1..02348f0 100644 --- a/docs/PHASE_0_11_AUDIT.md +++ b/docs/PHASE_0_11_AUDIT.md @@ -83,5 +83,5 @@ permission. Formal publication remains exclusively a maintainer action. No second-review finding remains open. Phase 11 becomes complete only after the reviewed PR merges through required checks, the manual release-candidate -workflow proves all four Native candidates plus the wasm1 asset and OIDC +workflow proves all supported Native candidates plus the wasm1 asset and OIDC attestations without publishing, and the resulting protected-main CI passes. diff --git a/docs/PHASE_11_REPORT.md b/docs/PHASE_11_REPORT.md index 620eb08..7871561 100644 --- a/docs/PHASE_11_REPORT.md +++ b/docs/PHASE_11_REPORT.md @@ -19,7 +19,7 @@ | --- | --- | --- | | PR-110 | Complete Mooncakes metadata, safe source archive, executable public API guide and exact MoonX coordinate | `moon package`, source verifier, 3 API documentation tests and local MoonX staging | | PR-111 | Explicit deny, inspect, CI and execute policies with security documentation | explicit deny, omitted-section default deny, read-only query and controlled/full execution smoke tests | -| PR-112 | Linux, macOS, Windows and wasm1 candidate artifacts with deterministic archives and checksums | platform matrix workflow, extraction verifier, exact version execution and external/embedded checksum validation | +| PR-112 | Linux x86_64, macOS arm64, Windows x86_64 and wasm1 candidate artifacts with deterministic archives and checksums | supported-platform matrix workflow, extraction verifier, exact version execution and external/embedded checksum validation | | PR-113 | Dependency/license audit, CycloneDX SBOM, SLSA-compatible provenance and OIDC candidate attestation | exact three-dependency audit, commit/toolchain/target binding and twelve-class tamper rejection | | PR-114 | Cache-independent source rebuild plus previous-candidate upgrade and rollback | fresh source tree, caches disabled, Phase 10 query/execution parity and exact-byte rollback | @@ -67,6 +67,11 @@ Native toolchain embeds target-path information, so the project does not claim path-independent Native bytes. Instead, independent source-package rebuilds must pass exact version, query and execution corpora. +The official MoonBit installer removed Intel macOS toolchain distribution, so +the reviewed candidate matrix explicitly excludes macOS x86_64 rather than +substituting an emulated result. The supported Native candidates are Linux +x86_64, macOS arm64 and Windows x86_64; wasm1 remains independently packaged. + ## Supply chain and upgrade Every Native candidate and the wasm1 MoonX asset carry a CycloneDX 1.5 SBOM diff --git a/docs/PROJECT_PLAN.md b/docs/PROJECT_PLAN.md index 80a411b..92c0154 100644 --- a/docs/PROJECT_PLAN.md +++ b/docs/PROJECT_PLAN.md @@ -701,7 +701,7 @@ Markdown 上游 oracle 证据见 | PR-114 | upgrade rehearsal | 从干净环境和上一 RC 升级/回滚 | 无本机缓存依赖；回滚文档可执行 | 执行状态：Phase 11 已于 2026-08-13 完成本地实现和第一轮严格验收。 -PR-110 至 PR-114 的 Mooncakes/MoonX staging、四类 wasm policy、四平台 +PR-110 至 PR-114 的 Mooncakes/MoonX staging、四类 wasm policy、三平台 Native 与 wasm1 候选制品、checksum/SBOM/provenance/OIDC attestation 流程、 十二类篡改拒绝和 Phase 10 到 Phase 11 升级/精确回滚证据见 [`PHASE_11_REPORT.md`](PHASE_11_REPORT.md)。仓库自动化只准备并验证候选物， @@ -709,6 +709,9 @@ Native 与 wasm1 候选制品、checksum/SBOM/provenance/OIDC attestation 流程 两轮远端 PR CI 与强制二次复核已经通过，审计见 [`PHASE_0_11_AUDIT.md`](PHASE_0_11_AUDIT.md)。candidate workflow、合并与 protected-main CI 完成前，阶段出口保持 pending。 +当前官方 MoonBit 安装链已移除 macOS x86_64 工具链分发，因此候选矩阵按 +第 3.3 节规则在 RC 前明确收缩为 Linux x86_64、macOS arm64 和 Windows +x86_64；不得以模拟结果替代，待官方恢复支持并通过真实 runner 后再扩展。 ### Phase 12：Beta、RC 和 GA diff --git a/docs/RELEASE_POLICY.md b/docs/RELEASE_POLICY.md index aef0a8d..bab5921 100644 --- a/docs/RELEASE_POLICY.md +++ b/docs/RELEASE_POLICY.md @@ -5,6 +5,12 @@ MoonJust prepares two related release candidates from the same reviewed commit: - the `moonbit-community/MoonJust` source module for Mooncakes; - prebuilt `cmd/just` executables for Linux, macOS, Windows and wasm1. +The reviewed Native candidate matrix is Linux x86_64, macOS arm64 and Windows +x86_64. macOS x86_64 is not claimed: the official MoonBit installer removed +Intel macOS toolchain distribution before this candidate was prepared. It must +not be restored to the matrix until an official supported toolchain is +available and the real-runner gate passes. + The source module version in `moon.mod`, the application version reported by `just --version`, and every artifact provenance statement are reviewed together. The candidate workflow refuses a dirty tree, an unclassified