From 0115e431229a09dcf7150f3acb31cabd200ab14b Mon Sep 17 00:00:00 2001 From: safishamsi Date: Sat, 26 Sep 2026 13:57:39 +0100 Subject: [PATCH] docs: align #3845 contributor guide with maintainer policy Follow-up edits on #3845 to match the settled maintainer decisions: - CODE_OF_CONDUCT.md: set the enforcement/reporting contact to safi@graphify.com (was an unspecified 'email the maintainer if known'). - README team-graph section: add the machine-local never-commit list (.graphify_root, .graphify_python, .graphify_analysis.json, the AST cache, needs_update) and the re-extract-to-update note. manifest.json stays committable since #3781 made its keys portable. - Add RELEASING.md (maintainer-facing): version bump + changelog + uv.lock, test on 3.10/3.13, push v8, gh release create -> PyPI via trusted publishing (no twine/token), verify with uvx --refresh. - CONTRIBUTING Further Reading: drop the paid Gumroad link, point at RELEASING.md instead. Co-Authored-By: Claude Opus 4.8 (1M context) --- CODE_OF_CONDUCT.md | 2 +- CONTRIBUTING.md | 2 +- README.md | 2 ++ RELEASING.md | 49 ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 53 insertions(+), 2 deletions(-) create mode 100644 RELEASING.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 2f5bee0db..bc71334af 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -36,7 +36,7 @@ This Code of Conduct applies within all community spaces, including the GitHub r ## Enforcement -Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project maintainers by directly messaging a Community Leader on the [Graphify Discord server](https://discord.gg/XDnKVpzdXB) or by emailing the maintainer directly if known. +Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project maintainers at safi@graphify.com, or by directly messaging a Community Leader on the [Graphify Discord server](https://discord.gg/XDnKVpzdXB). All complaints will be reviewed and investigated promptly and fairly. All community leaders are obligated to respect the privacy and security of the reporter of any incident. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e4a4fbb56..7f3ba91ca 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -148,4 +148,4 @@ Focus on the problem first, proposed behavior, alternatives, and compatibility c - [ARCHITECTURE.md](ARCHITECTURE.md) - [SECURITY.md](SECURITY.md) - [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) -- [The Memory Layer](https://safishamsi.gumroad.com/l/qetvlo) +- [RELEASING.md](RELEASING.md) (maintainers) diff --git a/README.md b/README.md index 5027e81f1..187f3001f 100644 --- a/README.md +++ b/README.md @@ -460,6 +460,8 @@ git add -f graphify-out/GRAPH_REPORT.md > `manifest.json` is now portable — keys are stored as relative paths and re-anchored on load, so committing it is safe and avoids a full rebuild on first checkout. +The remaining `graphify-out/` files stay machine-local and should **not** be force-added: `.graphify_root` and `.graphify_python` (absolute paths to this machine's scan root and interpreter), `.graphify_analysis.json`, the AST cache under `graphify-out/cache/`, and the `needs_update` flag. A teammate who pulls the shared `graph.json` can query it immediately; running `graphify update` re-anchors the committed `manifest.json` and rebuilds only what changed on their machine. + ### Recommended workflow Set this up once per clone. From then on, three of your normal git commands keep the graph current by themselves, and one keeps it in sync with your team: diff --git a/RELEASING.md b/RELEASING.md new file mode 100644 index 000000000..f62859b90 --- /dev/null +++ b/RELEASING.md @@ -0,0 +1,49 @@ +# Releasing graphify + +Maintainer-facing release process. Contributors do not need this; see +[CONTRIBUTING.md](CONTRIBUTING.md) for how to propose changes. + +graphify publishes to PyPI (package name `graphifyy`) automatically through +GitHub trusted publishing. There is no manual `twine` upload and no API token to +manage. + +## Steps + +1. **Bump the version.** Edit `version` in `pyproject.toml`. +2. **Update the changelog.** Add a dated section for the new version at the top of + `CHANGELOG.md`, crediting each landed PR and its author. +3. **Refresh the lock.** Run `uv lock` so `uv.lock` records the new version (and + any dependency changes). +4. **Test on both supported interpreters.** Run the full suite on Python 3.10 and + 3.13: + ```bash + uv run pytest + # and against a 3.13 environment, e.g. + uv run --python 3.13 pytest + ``` +5. **Commit and push `v8`.** Commit the version, changelog, and lock together, + then `git push origin v8`. +6. **Cut the GitHub release.** Tag the release off `v8`: + ```bash + gh release create vX.Y.Z --repo Graphify-Labs/graphify --target v8 \ + --title "vX.Y.Z" --notes-file + ``` + Publishing the release fires `publish.yml` on the `release-published` event, + which builds the wheel/sdist and uploads to PyPI via trusted publishing. Do + **not** run `twine` or pass a token. +7. **Verify the install** once PyPI has the new version (the JSON API updates + before the install index; use `--refresh`): + ```bash + uvx --refresh --from graphifyy==X.Y.Z graphify --version + ``` + +## Version numbering + +Keep public versions contiguous. If a number was bumped locally but never +published to PyPI, reuse that number for the next release rather than leaving a +gap. + +## Supported versions + +Security fixes target only the latest released `0.9.x`. See +[SECURITY.md](SECURITY.md).