justinmclean opened a new pull request, #543:
URL: https://github.com/apache/airflow-steward/pull/543
## Summary
Adds the `release-rc-cut` skill (Drafting mode) covering Steps 4 to 5 of the
release-management lifecycle: it emits paste-ready command sequences to tag
an
RC, build artefacts, sign each one, generate checksums, and stage to the
adopter's distribution backend. The skill runs nothing locally and never
handles the RM's signing key. Registered in `.agents` / `.claude` / `.github`
skill dirs and in the labels-and-capabilities table (`capability:resolve`).
Ships a 9-case behavioral eval suite across three steps (pre-flight,
tag/build/
sign/checksum, staging), plus a small grading enhancement to the eval runner.
## Skill behaviour highlights
- Golden rules enforce: agent never runs commands locally, never touches the
signing key, SHA-512 only by default (SHA-256 when configured, MD5/SHA-1
never), every state change is a proposal, and a `dist/release/` denylist
(RC staging is `dist/dev/` only).
- External content (planning issues, build config) is treated as data, with
an
adversarial eval case for prompt injection.
## Eval runner change
- Deterministic assertions now honor `"negate": true`, so a predicate can
assert the *absence* of a match (`has_no_passphrase_arg`, `has_no_md5sum`,
`has_no_sha1sum`). A spec error (`None`) passes through unflipped, so a
real
`--passphrase` leak is still caught. Covered by two new unit tests.
## Eval fixtures
- `has_sha256sum` lives in the suite-level `assertions.json` (the runner
reads
assertions only from the suite `fixtures/` dir; per-case files are
ignored).
Removed five dead per-case `assertions.json` files.
- Added `grading-schema.json` marking `section_2_build_command` as a prose
field, since the model may emit the build command bare or wrapped with the
spec's `# Run at the release tag <version>-<rcN>` comment header. Both are
correct, so exact match was brittle.
- README run commands corrected (`--directory` +
## Type of change
- [X ] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
- [ ] Tool / bridge contract (`tools/<system>/*.md`)
- [ ] Python package (`tools/*/` with `pyproject.toml`)
- [ ] Groovy reference impl
- [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
- [ ] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
- [ ] Project template (`projects/_template/`)
- [ ] CI / dev loop (`prek`, workflows, validators)
- [ ] Other:
## Test plan
- [X] `prek run --all-files` passes
- [ ] For Python packages touched: `uv run pytest` / `ruff check` / `mypy`
passes
- [ ] For Groovy bridges touched: command-line invocation tested end-to-end
- [X] For skill changes: eval suite passes for the affected skill
(`PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner
tools/skill-evals/evals/<skill>/`)
- [ ] For skill *behaviour* changes: a new or updated eval fixture is
included in this PR
(a regression test for the bug fixed / the behaviour added — see
CONTRIBUTING.md)
- [ ] Other:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
