chore(scripts): add upstream-sync-check.sh for monthly sync cadence - #44
Merged
Merged
Conversation
Implements the script referenced by CLAUDE.md "Upstream sync cadence". Read-only diagnostic that reports: 1. Missed backports on the pinned minor line — .patch.N tags on the exact pin tag plus newer vX.Y.W (and their .patch.N) on the same minor line. 2. Newer minor lines stabilized since our pin, with the latest stable tag on each. 3. Commit volume on upstream/main since the pin, with a 5-commit recent sample. 4. Security-flagged subjects since the pin (regex covers [SECURITY], fix(auth)/fix(security), CVE-N, SSRF, IDOR, bypass, injection, sandbox, hijack, traversal, disclosure, VERIA-). Auto-discovers the pin from CLAUDE.md "Current pinning" so a version bump only requires updating that block — the script picks up the new pin with no other changes. Verified locally: - --help renders inline usage from the script header - --no-fetch reports 5 backports, 4 newer minors, 1991 main commits, 37 security-flagged subjects (matches and extends the manual A+B+C audit done earlier in CLAUDE-driven planning). Removes the "(TODO)" marker on the script reference in CLAUDE.md. Tier: B (internal infra — script for our sync workflow, not pushed upstream).
7 tasks
songkuan-zheng
added a commit
that referenced
this pull request
Jun 4, 2026
The historical description ("Upstream-sync working branch | collects
upstream commits") implied a continuous mirror that internal/* must
serve. In practice we never used it that way — internal/v1.83.10-stable
just passively accumulated 1700+ upstream commits we never consumed.
Now that scripts/upstream-sync-check.sh (added in #44) covers routine
sync visibility, internal/<pin>-stable's remaining value is as a
sandbox to test-merge upstream/main before a version bump (catches
conflicts without polluting the ship branch).
Updates:
- Branching strategy table row: mark branch as Optional, describe the
actual bump-preview use case, drop "Upstream-sync working branch"
framing.
- Paragraph under the table: point at scripts/upstream-sync-check.sh
for routine awareness; explicitly note the internal/<pin>-stable
sandbox is opt-in, not a continuous mirror.
No code or other docs touched.
Tier: B (internal infra / policy doc, not pushed upstream).
4 tasks
songkuan-zheng
added a commit
that referenced
this pull request
Jun 4, 2026
…ning (#55) Ports the current state of ` CLAUDE.md`, ` scripts/upstream-sync-check.sh`, and ` .github/pull_request_template.md` from ship/v1.83.10 to ship/v1.87.0, and flips the Current pinning block to point at v1.87.0. Before this PR the policy doc was orphaned: Wave 2 (#47) cherry-picked an OLD version of CLAUDE.md from f67766f (when our policy doc was a 50-line skeleton). PRs #43, #45 added the Tier classification, Current pinning, and Upstream sync cadence sections on ship/v1.83.10, but they never crossed over to ship/v1.87.0. PR #44 added ` scripts/upstream-sync-check.sh` on ship/v1.83.10 only. After this PR, ship/v1.87.0 has the full policy state, and the sync script auto-discovers ` v1.87.0` from CLAUDE.md (verified locally — reports 100 commits on upstream/main since the new pin, 0 missed backports, 0 newer minor lines). ## Changes - ` CLAUDE.md` - Current pinning block flipped to v1.87.0 (Upstream pin, Ship branch, Upstream-sync branch, Internal release tag pattern). - Branching strategy table examples updated to ` v1.87.0` / ` ship/v1.87.0` / ` internal/v1.87.0-stable`. The pin tag column notes the historical ` vX.Y.Z-stable` form (used pre-1.84.0) so older grep results still resolve. - Cutting an internal release example updated to ` v1.87.0-internal.1` (N restarts at 1 under the new pin per the release-tag.sh contract). - Upstream sync cadence example covers both the new ` vX.Y.W` and the legacy ` .patch.N` patch-tag conventions. - ` git tag -l 'v1.87.0-internal.*'` for the latest-release lookup. - ` scripts/upstream-sync-check.sh` — copied verbatim from ship/v1.83.10. Re-reads the new pin without any code change. - ` .github/pull_request_template.md` — copied verbatim from ship/v1.83.10 (Tier classification checkbox section). Tier: B (internal policy / branding doc; not pushed upstream).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tier classification
litellm_extras/only)litellm/corelitellm/coreIf Tier C or D, did you try upstream first?
Relevant issues
None — closes the "(TODO)" placeholder added in #43.
Summary
Implements
scripts/upstream-sync-check.sh, the read-only diagnosticreferenced by
CLAUDE.md→ "Upstream sync cadence". Without this, themonthly sync ritual has nothing to run.
Reports four things:
.patch.Ntags onthe exact pin tag plus newer
vX.Y.W(and their.patch.N) on thesame minor.
stable tag on each (quarterly bump candidates).
upstream/mainsince the pin, with a 5-commitrecent sample.
[SECURITY],fix(auth),fix(security),CVE-N,SSRF,IDOR,bypass,injection,sandbox,hijack,traversal,disclosure,VERIA-.Pin is auto-discovered from
CLAUDE.md→ "Current pinning". Futureversion bumps don't need to touch this script.
Verification (run locally)
Sample output on the current state of
ship/v1.83.10:This output matches and extends the manual A+B+C audit done earlier
(the script surfaced extra VERIA-39 / VERIA-43 / VERIA-8 items the
manual list missed).
Pre-Submission checklist
set -euo pipefail,chmod +x,#!/usr/bin/env bash.scripts/release-tag.sh.Current pinningconvention from docs(claude): version-agnostic refs + Tier classification + sync cadence #43 — pinauto-discovered from
CLAUDE.md.make test-unitnot affected.Type
🚄 Infrastructure