diff --git a/CHANGELOG.md b/CHANGELOG.md --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,46 @@ --- +## [0.17.3] - 2026-08-01 + +Point release on the 0.17.x line, focused on **release-artifact integrity**. The 0.17.2 release shipped +two defects that every existing check missed because they validated only the generated `dist/` tree, never +the packaged artifact: the `hydra-build` sdist shipped 3 of 8 modules, and the published Java `hydra-kernel` +jar was a whole [#417](https://github.com/CategoricalData/hydra/issues/417) rename behind. This release adds +an artifact-level publish-completeness gate that inspects the actual uploaded archive, closing that class of +defect across all five registries. + +### Highlights + +- **Artifact-content completeness gate** ([#621](https://github.com/CategoricalData/hydra/issues/621)): + every publish path (Hackage sdist, Maven-Java jar, Maven-Scala jar, PyPI wheel, npm tarball) now inspects + the *packaged* archive and hard-fails if any module a package's manifest declares is missing. The gate also + asserts the post-#417 class names are present in the Java kernel jar. + +### Bug fixes + +- **PyPI wheels dropped non-`hydra.*` roots** ([#621](https://github.com/CategoricalData/hydra/issues/621)): + the wheel packaging hardcoded `packages = ["src/main/python/hydra"]`, silently omitting `hydra-pg`'s + `com.gdblab.*` and `openGql.*` modules. The generator now ships every emitted top-level root. + +### Improvements + +- **CI guard for dist-tree completeness** ([#524](https://github.com/CategoricalData/hydra/issues/524)): + asserts every manifest `mainModules` namespace is emitted into `dist/haskell`, catching the 0.17.2 + `hydra-build` truncation at the tree level (the artifact gate is the packaged-archive counterpart). +- **Manifest generation extracted** into `Hydra.ManifestGeneration`, and the structurally-unneeded #607 + sed shims dropped ([#622](https://github.com/CategoricalData/hydra/issues/622)). +- **Release-verification signing fix** ([#441](https://github.com/CategoricalData/hydra/issues/441)): + sign the reproducible uncompressed `.tar` and verify the `.asc` against the GitHub Release asset. +- **Java CI signing gate** ([#591](https://github.com/CategoricalData/hydra/issues/591)): `publishToMavenLocal` + skips gpg signing when no key is present. + +### Internal + +- Version bump to 0.17.3; `hostVersion` advanced to 0.17.2 and the temporary #417 Java/Python local-host + shims removed now that 0.17.2 is published on the registries + ([#417](https://github.com/CategoricalData/hydra/issues/417)). + ## [0.17.2] - 2026-07-28 Point release on the 0.17.x line. Themes: promotion of the generator's routing and manifest diff --git a/hydra-build.cabal b/hydra-build.cabal --- a/hydra-build.cabal +++ b/hydra-build.cabal @@ -5,7 +5,7 @@ -- see: https://github.com/sol/hpack name: hydra-build -version: 0.17.3 +version: 0.17.4 synopsis: Hydra's build system, promoted into Hydra description: Hydra is an implementation of the LambdaGraph data model, which takes advantage of an isomorphism between labeled hypergraphs and typed lambda calculus: in Hydra, "graphs are programs, and programs are graphs". This package is Hydra's build system, promoted into Hydra itself: the manifest-derived module-to-package router, kernel/host reconciliation utilities, and pure module-list helpers, expressed as Hydra modules and generated into every self-hosting dialect. It builds on hydra-kernel. category: Data @@ -31,6 +31,7 @@ Hydra.Build.Libraries Hydra.Build.ManifestWriter Hydra.Build.Modules + Hydra.Build.PackagingProfile Hydra.Build.Reconcile Hydra.Build.Routing Hydra.Decode.Build.Format @@ -43,6 +44,6 @@ build-depends: base >=4.19.0 && <4.22 , containers >=0.6.7 && <0.8 - , hydra-kernel ==0.17.3 + , hydra-kernel ==0.17.4 , scientific >=0.3.7 && <0.4 default-language: Haskell2010 diff --git a/src/main/haskell/Hydra/Build/PackagingProfile.hs b/src/main/haskell/Hydra/Build/PackagingProfile.hs new file mode 100644 --- /dev/null +++ b/src/main/haskell/Hydra/Build/PackagingProfile.hs @@ -0,0 +1,72 @@ +-- Note: this is an automatically generated file. Do not edit. + +-- | Per-package packaging-validation policy: strict vs. doc-relaxed profile selection and native-owned exclusion + +module Hydra.Build.PackagingProfile where + +import qualified Hydra.Ast as Ast +import qualified Hydra.Coders as Coders +import qualified Hydra.Core as Core +import qualified Hydra.Docs as Docs +import qualified Hydra.Error.Checking as Checking +import qualified Hydra.Error.Core as ErrorCore +import qualified Hydra.Error.File as ErrorFile +import qualified Hydra.Error.Packaging as ErrorPackaging +import qualified Hydra.Error.System as ErrorSystem +import qualified Hydra.Errors as Errors +import qualified Hydra.File as File +import qualified Hydra.Graph as Graph +import qualified Hydra.Json.Model as Model +import qualified Hydra.Overlay.Haskell.Lib.Lists as Lists +import qualified Hydra.Overlay.Haskell.Lib.Logic as Logic +import qualified Hydra.Packaging as Packaging +import qualified Hydra.Parsing as Parsing +import qualified Hydra.Paths as Paths +import qualified Hydra.Query as Query +import qualified Hydra.Regex as Regex +import qualified Hydra.Relational as Relational +import qualified Hydra.System as System +import qualified Hydra.Tabular as Tabular +import qualified Hydra.Testing as Testing +import qualified Hydra.Time as Time +import qualified Hydra.Topology as Topology +import qualified Hydra.Typed as Typed +import qualified Hydra.Typing as Typing +import qualified Hydra.Util as Util +import qualified Hydra.Validate.Packaging as ValidatePackaging +import qualified Hydra.Validation as Validation +import qualified Hydra.Variants as Variants +import Prelude hiding (Enum, Ordering, decodeFloat, encodeFloat, fail, map, pure, sum) +import qualified Data.Scientific as Sci + +-- | Whether a package's dist/json is written by a separate native driver, so it is excluded from structural validation +isNativeOwned :: Packaging.Package -> Bool +isNativeOwned pkg = Lists.member (Packaging.packageName pkg) nativeOwnedPackagingPackages + +-- | Packages whose dist/json is written by a separate native driver, hence excluded from structural validation +nativeOwnedPackagingPackages :: [Packaging.PackageName] +nativeOwnedPackagingPackages = + [ + Packaging.PackageName "hydra-jvm", + (Packaging.PackageName "hydra-java"), + (Packaging.PackageName "hydra-python")] + +-- | Select the packaging validation profile for a package: full-fatal for strict packages, doc-relaxed otherwise +packagingProfileFor :: Packaging.Package -> Validation.ValidationProfile +packagingProfileFor pkg = + Logic.ifElse (Lists.member (Packaging.packageName pkg) strictPackagingPackages) ValidatePackaging.kernelDefaultPackagingProfile ValidatePackaging.kernelPackagingProfileWithDocWarnings + +-- | Packages held to the full, fatal-on-everything packaging profile +strictPackagingPackages :: [Packaging.PackageName] +strictPackagingPackages = + [ + Packaging.PackageName "hydra-kernel", + (Packaging.PackageName "hydra-build"), + (Packaging.PackageName "hydra-haskell"), + (Packaging.PackageName "hydra-go"), + (Packaging.PackageName "hydra-lisp"), + (Packaging.PackageName "hydra-wasm"), + (Packaging.PackageName "hydra-typescript"), + (Packaging.PackageName "hydra-rdf"), + (Packaging.PackageName "hydra-pg"), + (Packaging.PackageName "hydra-ext")]