Group release-notes site by support status (stable/preview) + audit drift check#4267
Merged
Merged
Conversation
Add a top-level `support` block to scripts/infra/docs/versions.json that declares the current Chrome Stable / Extended-stable / Beta milestones (a SkiaSharp minor number is the Chrome/Skia milestone). The release-notes generator now groups the TOC and index by support status: - Supported: the stable, extended_stable, and beta lines (each tagged Stable / Extended stable / Beta) - Out of support: every other 3.x+ line (folded into a single node / collapsed <details>) - Obsolete: 1.x and 2.x lines (folded) An absent/empty `support` block degrades to the legacy flat layout, so the change is purely additive. The block is maintained by hand on each release; the page generators only read it and never fetch the network. The generated TOC.yml/index.md are intentionally left for the update-release-notes pipeline to regenerate. Documented in documentation/dev/release-notes-and-api-diffs.md §3.5 and invariant 10. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reframe the release-notes support grouping around SkiaSharp's actual NuGet release paths (it is not a multi-tier channel product) and add a read-only drift check so we know when the hand-maintained block falls out of date. versions.json: replace the three-field `support` block (stable / extended_stable / beta) with two lists — `stable` and `preview` — of the milestone lines SkiaSharp actually ships. Maintained by hand on each release; never auto-derived (we don't ship every Chrome milestone). generate-release-notes.py: read the two lists, label supported lines Stable / Preview, and keep the Out-of-support / Obsolete folds. Empty/absent block still degrades to the legacy flat layout. query-milestone-schedule.py (security-audit Step 3): the heads-up run already fetches the live Chrome channels, so it now also compares the support lists to them and emits an ok/warn/drift verdict in a new `support` JSON section. The decision table allows the promotion gap (stable on Chrome Extended while a preview reaches Chrome Stable) and warns when previewing ahead in Dev/Canary; it flags stable behind/off-channel and a preview that isn't ahead of stable as drift. Detection only — the fix is always a manual edit of versions.json. Docs: rewrite spec §3.5 + invariant 10 for the two-list model and the drift check; document the comparison + table in the security-audit SKILL Step 3 and references/milestone-schedule.md. The CI-generated TOC.yml/index.md are intentionally left for the release-notes pipeline to regenerate and validate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
📦 Try the packages from this PRWarning Do not run these scripts without first reviewing the code in this PR. Step 1 — Download the packages bash / macOS / Linux: curl -fsSL https://raw.githubusercontent.com/mono/SkiaSharp/main/scripts/get-skiasharp-pr.sh | bash -s -- 4267PowerShell / Windows: iex "& { $(irm https://raw.githubusercontent.com/mono/SkiaSharp/main/scripts/get-skiasharp-pr.ps1) } 4267"Step 2 — Add the local NuGet source dotnet nuget add source ~/.skiasharp/hives/pr-4267/packages --name skiasharp-pr-4267More options
Or download manually from Azure Pipelines — look for the Remove the source when you're done: dotnet nuget remove source skiasharp-pr-4267 |
Open index.md with a Support overview block — a stable/preview/out-of- support/obsolete lifecycle legend plus a table of the currently-supported lines and their latest release — so the page leads with the process and what to use, before the detailed per-line lists. Gated on a configured support block; the legacy flat layout is unchanged when absent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
📖 Documentation Preview The documentation for this PR has been deployed and is available at: 🔗 View Staging Site This preview will be updated automatically when you push new commits to this PR. This comment is automatically updated by the documentation staging workflow. |
mattleibow
added a commit
that referenced
this pull request
Jun 29, 2026
…ne skill, honest run signal (#4258) Harden Skia upstream-sync: conflict policy, durable gn args, standalone skill, honest run signal (#4258) Follow-up to the mode=main tip work (#4254) and release-line targeting (#4239). The first real tip runs exposed three rough edges in the auto-skia-sync automation, plus that key Skia-update knowledge lived only in the workflow prompt where the update-skia skill couldn't reach it. ~~ Verify-upstream-or-reapply conflict resolution ~~ A tip merge runs ~291 commits ahead of our submodule base and conflicts on every file carrying an [M1xx] fork cherry-pick. The old "keep ours / resolve what you reasonably can" guidance risked silently dropping a not-yet- upstreamed patch (--theirs) or freezing a stale form of one upstream had since refined (--ours; e.g. our SDF-LCD patch used getMaxScale() while upstream relanded it as sk_ieee_float_divide(1.f, getMinScale())). Replace it with an explicit, auditable policy: classify each fork patch on a conflicted file as upstreamed (take upstream's form, record the SHA) or not upstreamed (re-apply ours on top) -- never a blanket --theirs/--ours, never a silent drop. A mandatory before-merge fork-patch snapshot is cross-checked so every patch lands in the resolution table as upstreamed or re-applied; a patch that is neither is a lost patch -> stop and fix. Applied across gotcha #15, SKILL.md Phase 5, and the workflow tip note. ~~ Allow a required new gn arg through build.cake ~~ The tip build needed skia_use_partition_alloc=false because upstream now defaults it to is_clang while our DEPS deliberately omits partition_alloc; Skia ships an official zero-overhead noop raw_ptr for exactly this case, so =false is the supported embedder path, not a hack. The rule banned all build.cake edits, forcing a one-off --gnArgs CLI flag and leaving durable config non-durable. Split the rule into two tiers: still forbid changing compiler/linker flags (or scripts/infra/native/**) to silence a host build error, but allow adding a genuinely required new upstream gn arg to the affected platforms' native/**/build.cake gn-args lists, flagged in both PR summaries for cross- platform review. Sequencing is honored: the toggle doesn't exist in m150, so the relaxed rule lets the next milestone merge add it in-context rather than breaking the current build. Recommendation for the eventual bump (gotcha #23): keep partition_alloc disabled via the supported noop, not by vendoring the Chromium allocator. ~~ Make the skill standalone; reduce the workflow to CI overrides ~~ main/tip mode and the required-new-gn-arg rule were documented only in the workflow prompt, so the update-skia skill couldn't drive them locally. Move both into the skill: tip mode becomes a first-class third option in Phase 1 (new {UPSTREAM_REF} variable, merge-base..upstream/main milestone diffs, generalized Phase 5 merge command), and the gn-arg rule lands in Phase 7 backed by gotcha #23. Trim the workflow's duplicated build.cake/mode prose to short pointers, keeping only genuinely CI-specific guardrails (can't apt- install in the sandbox; a missing host dep is a workflow bug, not a flag hack; Linux-only-build cross-platform review). These are prompt-body edits, so the lock stays byte-identical. ~~ Stop mislabeling a real sync as a no-op ~~ A sync that merged upstream, built, tested, and opened both PRs was reported by the gh-aw conclusion job as a no-op, which then failed trying to file a no-op issue (the workflow has no issues: write). Cause: safe-outputs staged mode blocks the agent from creating anything directly -- the real PRs are opened by the host post-step skia-sync-push-prs.sh with the autobump token -- so noop was the agent's only completion signal and every run, real or not, signalled noop. Give the agent an honest signal: declare create-pull-request in safe-outputs, kept staged (preview-only; the safe_outputs job is ubuntu-slim with permissions:{} and never touches the workspace) so a real sync registers as a pull-request output, while real PRs still come only from the post-step. Set noop: report-as-issue: false so noop is reserved for genuine no-work runs and no longer files an uncreatable issue; drop the unused create_issue offer; and add a "Completion signal" section to the prompt. This is the one frontmatter edit in the PR, so auto-skia-sync.lock.yml is regenerated. Validated end-to-end by run 28269474099 (mode=main, real 2-commit merge): the agent emitted a staged create_pull_request, the conclusion logged no noop with no failed issue step, and the post-step still pushed skia-sync/main to both repos and updated the real PRs (#4263 + #269). Rebased on main to pick up the #4260 workflow rename (lock recompiled to a 0-diff) and confirm consistency with the #4267 support-status model. Co-authored-by: Matthew Leibowitz <mattleibow@live.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
The release-notes site (
documentation/docfx/releases/) listed every SkiaSharp version in one flat list. This reorganizes it by support status so the sidebar and landing page surface what's actually supported and fold away the rest, and adds a read-only drift check so we get told when our declared support tiers fall out of step with Chrome's live channels.Model
scripts/infra/docs/versions.jsongains a hand-maintainedsupportblock with two lists matching SkiaSharp's real NuGet release paths (we ship NuGets, not Chrome's 5 channels):stable— the supported stable line (Chrome Stable, or Chrome Extended Stable during a promotion gap).preview— the in-flight preview/RC line (Chrome Beta or newer).Currently
{ "stable": ["4.148"], "preview": ["4.150"] }— 4.148 sits on Chrome Extended Stable while 4.150 is the preview about to promote (149 was skipped). Maintained by hand: SkiaSharp doesn't ship every Chrome milestone, so auto-deriving the block could point tiers at milestones that have no release line.Docs output (regenerated by CI, verified on a
workflow_dispatchrun)TOC.yml: supported4.150.x/4.148.xstay at top;4.147.x → 3.0.xfold under "Out of Support Versions";2.x/1.xunder "Obsolete Versions".index.md: intro prose →## Supported versions(4.150.x — Preview, 4.148.x — Stable) → folded## Out of support→ folded## Obsolete versions.Drift check (merged into the existing security-audit heads-up)
.agents/skills/security-audit/scripts/query-milestone-schedule.pyalready fetches the live Chrome channels, so it now also compares them to the support lists and emits anok/warn/driftverdict (newsupportJSON section + summary block). Detection only — the fix is a manual edit ofversions.json. Rules enforced:{Extended, Stable}; never only Extended without a promoting preview.Full decision table unit-tested across 12 scenarios. Against today's channels (E148 / S149 / B150) it reports 🟢 OK — promotion gap.
Files
scripts/infra/docs/versions.json— two-listsupportblock + commentsscripts/infra/docs/generate-release-notes.py— reads two lists, tags Stable/Preview, folds out-of-support/obsolete.agents/skills/security-audit/scripts/query-milestone-schedule.py—build_support_alerts()+ JSON/summary wiring.agents/skills/security-audit/SKILL.md,.agents/skills/security-audit/references/milestone-schedule.md— document the drift checkdocumentation/dev/release-notes-and-api-diffs.md— §3.5 rewrite + invariant 10CI-generated
TOC.yml/index.mdare intentionally not committed here — the release-notes pipeline regenerates them onmain.Validation
Dispatched the "Sync - Release Notes & API Diffs" pipeline against this branch: the generator ran with
errors: []and produced the groupings above. (The run's finalsafe_outputsPR step is red only because validating an unmerged branch bundles the protected.agents/**edits into its candidate PR; onmainthat step regenerates docfx files only and won't trip the guard.)