Bind migration heads to coordinated releases

2026-08-04 14:55:58 +02:00
parent d9522d3cc4
commit 077735bc24
3 changed files with 21 additions and 0 deletions
@@ -59,6 +59,11 @@ Core next, and the meta tag last. This is a dependency guarantee for a
 single-capacity Actions runner: the developer package cannot run before its
 exact Core and module versions have entered the queue.

+The same release entry point records the reviewed current Alembic heads under
+the target release version and reruns the strict migration audit before it
+changes package versions, commits, or tags. A failed baseline check therefore
+cannot produce a protected package release.
+
 It builds one wheel and, where applicable, one npm tarball. The workflow records
 the source tag, source commit, filename, size, and SHA-256 in
 `package-artifacts.json` before publishing. Gitea rejects a second upload of the