chore(release): document hardening and verify complete source package composition

2026-09-08 02:06:35 +02:00
parent 6a8f53b87d
commit 32fe4b7238
9 changed files with 585 additions and 13 deletions
@@ -86,6 +86,16 @@ contract. The coordinated release synchronizes `peerDependencies` and
 tag, then synchronizes each lockfile root from the final package metadata. A
 distinct root package remains independent.

+Every module referenced by Core's Git-based `package.release.json` must expose
+its WebUI identity at the repository root, including matching peer requirements
+and `webui/`-prefixed entry exports (also CSS subpaths). npm resolves Git
+dependencies from the repository root, while the native-package workflow packs
+`webui/`; success in one path does not verify the other. Run
+`python tools/checks/check-webui-package-facades.py` after changing either
+manifest or the release composition. The focused gate also runs this check.
+Adding or correcting a facade in an already published repository requires a
+new patch tag; never repair an existing immutable tag in place.
+
 It builds one wheel and, where applicable, one npm tarball. The workflow records
 the source tag, source commit, filename, size, and SHA-256 in
 `package-artifacts.json` before publishing. Gitea rejects a second upload of the