Automated Public Release

MindLab-Research/longstraw-alpha is the private collaboration repository. The matching public snapshot is MindLab-Research/longstraw. Publication is performed by the organization mindlab-bot; project members do not push the public repository directly.

Release workflow

The checked-in workflow is the canonical Release to Public workflow. It runs on the organization self-hosted runner, derives the project name by removing -alpha, clones mindlab-bot, and invokes its release skill. It supports both pushed v* tags and manual dispatch with a tag name and optional force flag.

The repository mapping is registered centrally as:

private: MindLab-Research/longstraw-alpha
public:  MindLab-Research/longstraw

The runner owns the bot token and SSH key. Credentials are never checked into this repository or passed from a developer workstation.

Normal release

Prepare and bind the source tree first. The binding commit must change only evidence/manifest.json:

git checkout main
git pull --ff-only
python3 scripts/check_release_tree.py
python3 scripts/check_release_tree.py --update-manifest
git add evidence/manifest.json
git commit -m "chore: bind release evidence manifest"
git push origin main

Then create the next version tag and push it:

git tag -a v0.2.1 -m "LongStraw v0.2.1"
git push origin v0.2.1

The tag push starts Release to Public. No direct push to the public repository is needed.

Verify publication

Check the private workflow first:

gh run list --repo MindLab-Research/longstraw-alpha \
  --workflow "Release to Public" --limit 5
gh run view RUN_ID --repo MindLab-Research/longstraw-alpha --log-failed

Then verify the public branch and tag:

git ls-remote https://github.com/MindLab-Research/longstraw.git \
  main refs/tags/v0.2.1
gh api repos/MindLab-Research/longstraw/commits/main \
  --jq '.commit.author.name'

The public commit author should be mindlab-bot. The public snapshot must not contain .github/; the private workflow is an internal publication mechanism.

Re-publication

Use a force release only when correcting an already-published snapshot or replacing an erroneous public history. Move the private tag explicitly and push the tag with force:

git tag -f v0.2.1 BOUND_COMMIT
git push -f origin refs/tags/v0.2.1

The workflow detects the tag update and passes --force to the release skill. Do not force-move a tag for an ordinary content update; publish a new version.

Signed artifacts

docs/release-signing.md and the offline bundle tooling describe a separate NVIDIA trust workflow for environments that require signed artifacts. They do not replace the organization-level Release to Public path for the public repository.