Preprod Release

.github/workflows/agent-release.yml

@@ -1,9 +1,15 @@
 name: Agent Release
 
-# Manually triggered. Enter the version (e.g. `0.0.3`).
+# Manually triggered from main. Enter the version (e.g. `0.0.3`).
+#
+# Release model:
+#   - Fast-forwarding main from develop = the maintainer's "this state is
+#     ready" signal (same gesture as the server release flow).
+#   - Agent release dispatches from main and tags main HEAD; develop can be
+#     arbitrarily ahead and doesn't affect what ships.
 #
 # Steps:
-#   1. validate version > latest agent/v* tag, FF prerequisite
+#   1. validate dispatched from main + version > latest agent/v* tag
 #   2. cross-build linux/{amd64,arm64} + darwin/{amd64,arm64} binaries
 #   3. tag main HEAD as agent/vX.Y.Z, push tag
 #   4. create GitHub release with binaries + sha256s
@@ -49,6 +55,12 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
+
+          if [ "${GITHUB_REF}" != "refs/heads/main" ]; then
+            echo "::error::This workflow must be dispatched from main (got ${GITHUB_REF})"
+            exit 1
+          fi
+
           VERSION="${{ inputs.version }}"
           VERSION="${VERSION#v}"
 
@@ -76,12 +88,6 @@ jobs:
             exit 1
           fi
 
-          git fetch origin develop
-          if ! git merge-base --is-ancestor origin/develop HEAD; then
-            echo "::error::develop has commits not in main. Fast-forward main from develop, then re-run."
-            exit 1
-          fi
-
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "tag=agent/v${VERSION}" >> "$GITHUB_OUTPUT"
           echo "prev_tag=${PREV_TAG}" >> "$GITHUB_OUTPUT"

.github/workflows/release.yml

@@ -16,10 +16,17 @@ name: Release
 # review, so main and develop never receive bot-authored direct pushes —
 # branch protection rulesets stay active.
 #
-# Prerequisite for dispatch: main must already be at or ahead of develop.
-# The manual fast-forward of main from develop is your "ready to ship" gate;
-# it triggers preprod deploy via path #1, giving you a chance to verify
-# before clicking Run workflow.
+# Release model:
+#   - Fast-forwarding main from develop = "release to preprod". The maintainer
+#     does this whenever they decide a develop state is ready to soak; it
+#     triggers path #1 above, which builds :stable and deploys preprod.
+#   - Production release dispatches from main, promoting whatever :stable
+#     currently is. develop can be arbitrarily ahead of main — it doesn't
+#     affect what ships.
+#
+# Dispatch must run from main (enforced below). There is no automated check
+# that main matches the preprod-soaked state; the maintainer's discipline
+# (FF main → wait for preprod → verify → dispatch) is the gate.
 
 on:
   push:
@@ -156,11 +163,17 @@ jobs:
           ref: main
           fetch-depth: 0
 
-      - name: Validate version & FF prerequisite
+      - name: Validate dispatch ref & version
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
+
+          if [ "${GITHUB_REF}" != "refs/heads/main" ]; then
+            echo "::error::This workflow must be dispatched from main (got ${GITHUB_REF})"
+            exit 1
+          fi
+
           VERSION="${{ inputs.version }}"
           VERSION="${VERSION#v}"
 
@@ -188,14 +201,6 @@ jobs:
             exit 1
           fi
 
-          # Confirm main is at or ahead of develop. If develop has commits not
-          # yet on main, the user forgot to FF main from develop before dispatch.
-          git fetch origin develop
-          if ! git merge-base --is-ancestor origin/develop HEAD; then
-            echo "::error::develop has commits not in main. Fast-forward main from develop, verify preprod, then re-run."
-            exit 1
-          fi
-
           echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           echo "TAG=v${VERSION}" >> "$GITHUB_ENV"
           echo "PREV_TAG=${PREV_TAG}" >> "$GITHUB_ENV"
@@ -236,7 +241,7 @@ jobs:
           DST="${{ env.IMAGE }}:${VERSION}"
 
           if ! crane manifest "$SRC" >/dev/null 2>&1; then
-            echo "::error::$SRC not found. Did you fast-forward main from develop and let the docker job complete before dispatching?"
+            echo "::error::$SRC not found. main must have been pushed (FF'd from develop) and the docker job completed before dispatching."
             exit 1
           fi
 

CHANGELOG.md

@@ -1,3 +1,24 @@
+## v1.0.0 (2026-05-03)
+
+## What's Changed
+
+- chore: update agent CHANGELOG.md for agent/v0.1.0 by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/179
+- fix(ui): icon-only sidebar session actions by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/183
+- feat(audit): session-lifecycle audit log + UI by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/187
+- chore(terminal): require CloseReason on TerminalManager.close() by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/188
+- feat(audit): persist signing requests and surface in UI (#186) by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/190
+- chore: adopt FSL-1.1-Apache-2.0 license by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/192
+- fix(licenses): cover all cbor-extract platform variants by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/196
+- chore: scrub internal references for public release by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/195
+- docs: consolidate agent instructions into CLAUDE.md and refresh positioning by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/198
+- Release PR by @rado0x54 in https://github.com/rado0x54/ShellWatch/pull/197
+
+## New Contributors
+
+- @github-actions[bot] made their first contribution in https://github.com/rado0x54/ShellWatch/pull/180
+
+**Full Changelog**: https://github.com/rado0x54/ShellWatch/compare/v0.1.0...v1.0.0
+
 ## v0.1.0 (2026-05-01)
 
 ## What's Changed