From 87dc71aecbdcbfb8d074019aecd42b7ff282ce52 Mon Sep 17 00:00:00 2001 From: Raimund Andree Date: Mon, 5 Oct 2026 21:50:27 +0000 Subject: [PATCH] chore(memory-bank): record the 5.0.0-rc2 release 5.0.0-rc2 is on the PowerShell Gallery and in the GitHub releases. The PRs #99 to #106 were merged in order with merge commits, CI on master passed, and the tag 5.0.0-rc2 on 7ddda8d published it on the third attempt of the release run, after GitHub's Actions outage of 2026-10-05. The open issues got their replies, 16 were closed, and the follow-up issues #107 to #111 track the open Minor review findings. - Decision 14: repository hardening is optional; the outdated "pending" text is gone. - Decision 15: merge stacked pull requests in order with merge commits. - Decision 16: fix only reproducible bugs (the maintainer's decision D6). - activeContext and progress: the CI fix 629f4e7, the copied inherited entries behind #34, the issue state, and the next step (test rc2, then 5.0.0 or rc3). - techContext: the current versions, the second workstation, and one-line commands for the maintainer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant --- .memory-bank/activeContext.md | 71 +++++++------- .../0014-repository-hardening-optional.md | 23 +++++ .../0015-merge-stacks-with-merge-commits.md | 19 ++++ .../0016-fix-reproducible-bugs-only.md | 16 ++++ .memory-bank/progress.md | 93 +++++++++---------- .memory-bank/systemPatterns.md | 3 + .memory-bank/techContext.md | 39 +++++--- 7 files changed, 162 insertions(+), 102 deletions(-) create mode 100644 .memory-bank/decisions/0014-repository-hardening-optional.md create mode 100644 .memory-bank/decisions/0015-merge-stacks-with-merge-commits.md create mode 100644 .memory-bank/decisions/0016-fix-reproducible-bugs-only.md diff --git a/.memory-bank/activeContext.md b/.memory-bank/activeContext.md index 2323c66..097d6a3 100644 --- a/.memory-bank/activeContext.md +++ b/.memory-bank/activeContext.md @@ -9,47 +9,42 @@ source: current task evidence ## Current focus -The overnight run of 2026-10-04/05 is finished. 5.0.0-rc2 waits on eight -stacked local branches (see `progress.md`): the maintainer pushes them, -opens one PR each against `master`, merges them in order with merge -commits, and tags `5.0.0-rc2` on the last merge commit once CI on `master` -is green. The run's report lists the commands, the PR descriptions, a -reply for each issue, and the open questions. - -## Maintainer decisions for the run (2026-10-04) - -- D1: the fixes ship in 5.0.0, under `[Unreleased]`; the behavior changes - of D3 and D4 are listed under `Changed` with the way back. -- D2: `Clear-NTFSAccess -DisableInheritance` keeps leaving an empty DACL. -- D3: `Set-NTFSInheritance` keeps entries like the dedicated cmdlets - (Decision 13). -- D4: `-RemoveInheritedAuditRules` and `-RemoveExplicitAuditRules`, with - the old names as aliases. -- D5: `Get-FileHash2` works in PowerShell 7; `MACTripleDES` is deprecated. -- D6: only reproducible bugs are fixed; other behavior changes are - questions for the maintainer. -- D7: Dependabot for `github-actions` only; AlphaFS 2.2.1 everywhere. -- D8: the manifest `Description` and a version-neutral README. -- D9: merged local branches deleted after the run. -- 2026-10-05: the report's recommendations accepted. #5 and #82 ship in - 5.0.0 as breaking changes; #34 for rc3 if a file server is available; - #41 and #90 after 5.0.0; Minor findings become issues; the `pwsh` crash - is watched in CI. +5.0.0-rc2 is published. On 2026-10-05 the PRs #99 to #106 were merged into +`master` in order, each with a merge commit, and the tag `5.0.0-rc2` on the +merge commit of #106 (`7ddda8d`) published the module to the PowerShell +Gallery and created the GitHub prerelease through CI (Decision 12). Next: +test the prerelease, answer the issues, and decide between 5.0.0 and an rc3 +for #34 and #67. ## Evidence -- Every branch tip: Release build without new warnings (296 at the top, - 305 at the baseline), docs checks clean, package dry run passed. -- Tests at the top branch: Windows PowerShell 423 passed, 26 skipped; - PowerShell 7 394 passed, 55 skipped (449). The baseline had 268 tests. -- Tests that need privileges skip on the workstation and run in CI only; - the PR descriptions list them. -- Reviews: one security review per PR; the Major findings were fixed in - the PR that had them (PR 1: 1, PR 2: 5, PR 4: 2, PR 6: 1, PR 7: 3, - PR 8: 2). +- The first CI runs of #100 to #106 failed an elevated test that had only + skipped on the workstation, and from #104 on a second one. The audit + inheritance cmdlets wrote no section for an item without a SACL, which + Windows answers with "Access is denied"; and a test read a descriptor with + its SACL, for which Windows doesn't mark the inherited entries of a DACL + that isn't in the auto-inherit format. Fixed test-first in `629f4e7` on + #106, red and green in both editions. +- CI of #106 at `629f4e7` and of `master` at `7ddda8d`: Windows PowerShell + 5.1 436 passed, 19 skipped; PowerShell 7 407 passed, 48 skipped; no + failures. Before the merges, a simulation showed that each merge leaves + `master` at the tree its pull request tested. +- The package from the Gallery imports in both editions as 5.0.0-rc2 with + 36 cmdlets and help, and `Disable-NTFSAuditInheritance` works on a file + without audit entries. +- The merges closed #3, #4, #5, #17, #74, #82, #86, and #88 and deleted the + eight `ai/` branches. Later that day the 37 issues that were open before + the merges got their replies, 16 of them were closed (as completed when + answered or already fixed, as not planned when not reproducible or won't + fix), and the follow-up issues #107 to #111 were created; 18 issues are + open. +- Found while fixing the CI: elevated, `Add-NTFSAccess` and `Add-NTFSAudit` + read the DACL together with the SACL, so the inherited entries of a DACL + without the auto-inherit flag come back as explicit entries, and the write + stores them as explicit copies. Same cause as #34: every section is read + and written; the fix for #34 covers both. ## Next step -The maintainer applies the repository settings, pushes the eight branches, -opens and merges the PRs in order, and tags `5.0.0-rc2` once CI on -`master` is green. +The maintainer tests 5.0.0-rc2, then decides between 5.0.0 and 5.0.0-rc3, +which would fix #34, #67, and the copied inherited entries. diff --git a/.memory-bank/decisions/0014-repository-hardening-optional.md b/.memory-bank/decisions/0014-repository-hardening-optional.md new file mode 100644 index 0000000..70fa110 --- /dev/null +++ b/.memory-bank/decisions/0014-repository-hardening-optional.md @@ -0,0 +1,23 @@ +--- +status: accepted +date: 2026-10-05 +last-verified: 2026-10-05 +owner: shared +source: maintainer decision of 2026-10-05 +--- + +# Decision 14: Repository hardening is optional + +- Choice: The repository settings proposed on 2026-10-04 stay optional: + required reviewers and a tag-only deployment policy for the environment + `powershell-gallery`, a ruleset for `master` that requires a pull request + and the **Build and test** check, and a rotation of `PSGALLERY_API_KEY`. + None of them is a gate for a merge or a release. +- Rationale: The maintainer is the only developer. The PRs #99 to #106 of + 5.0.0-rc2 were merged on 2026-10-05 without these settings. +- Consequences: `master` accepts a merge while checks fail, and the Release + job publishes without an approval. The safeguards are the CI run of the + last pull request of a stack before its merges, the CI run on `master` + before the tag, and the checks of the Release job (Decision 12). Agents + don't press for the settings; the proposal stays with the maintainer, + outside the repository. diff --git a/.memory-bank/decisions/0015-merge-stacks-with-merge-commits.md b/.memory-bank/decisions/0015-merge-stacks-with-merge-commits.md new file mode 100644 index 0000000..45c6db6 --- /dev/null +++ b/.memory-bank/decisions/0015-merge-stacks-with-merge-commits.md @@ -0,0 +1,19 @@ +--- +status: accepted +date: 2026-10-05 +last-verified: 2026-10-05 +owner: shared +source: maintainer decision of 2026-10-05 +--- + +# Decision 15: Merge stacked pull requests in order with merge commits + +- Choice: A stack of pull requests whose branches build on each other is + merged into `master` in order, each with **Create a merge commit**. The + merges wait for the CI run of the last pull request, which contains every + commit of the stack; an earlier one may fail tests that a later one fixes. +- Rationale: Squash and rebase merges rewrite the commits, so every later + pull request would conflict, and the commit IDs in the descriptions and + the changelog would no longer exist on `master`. A merge commit keeps + them, and each merge leaves `master` at the tree its pull request tested. +- Applied: 5.0.0-rc2, the PRs #99 to #106 on 2026-10-05. diff --git a/.memory-bank/decisions/0016-fix-reproducible-bugs-only.md b/.memory-bank/decisions/0016-fix-reproducible-bugs-only.md new file mode 100644 index 0000000..ad6a480 --- /dev/null +++ b/.memory-bank/decisions/0016-fix-reproducible-bugs-only.md @@ -0,0 +1,16 @@ +--- +status: accepted +date: 2026-10-04 +last-verified: 2026-10-05 +owner: shared +source: maintainer decision D6 for the overnight run of 2026-10-04 +--- + +# Decision 16: Fix only reproducible bugs + +- Choice: Agents fix a defect only when they can reproduce it. Any other + change of behavior, also one that a review recommends, is a question for + the maintainer. +- Rationale: The maintainer's decision D6 for the overnight run of + 2026-10-04. It kept the run's changes to reproduced defects and left the + behavior changes, such as #5 and #82, to his decision of 2026-10-05. diff --git a/.memory-bank/progress.md b/.memory-bank/progress.md index 5cf0f32..2f4aa77 100644 --- a/.memory-bank/progress.md +++ b/.memory-bank/progress.md @@ -9,14 +9,11 @@ source: repository evidence ## Current status -5.0.0-rc2 is ready on eight stacked local branches from the overnight run of -2026-10-04/05; none is pushed. Each is a PR against `master`, merged in -this order with merge commits: `ai/maintenance`, `ai/defects-a`, -`ai/defects-b`, `ai/defects-c`, `ai/defects-d`, `ai/decisions-e`, -`ai/issue-fixes`, `ai/release-5.0.0-rc2`. The tag `5.0.0-rc2` on the last -merge commit then publishes it through CI (Decision 12). `master` -(`e0f5366`) carries 5.0.0-rc1, published on 2026-10-04; the stable Gallery -version is still 4.2.6. +5.0.0-rc2 is on the PowerShell Gallery and in the GitHub releases, +published by CI from the tag `5.0.0-rc2` on `master` (`7ddda8d`) on +2026-10-05 (Decision 12). It contains the 24 code defects of work package +5, the issue fixes of the overnight run of 2026-10-04/05, and the CI fix +`629f4e7`. The stable Gallery version is still 4.2.6. ## Recent milestones @@ -27,20 +24,19 @@ version is still 4.2.6. - 2026-10-04: #98 (`e0f5366`) added releases on a version tag through CI (Decision 12). The tag `5.0.0-rc1` published to the Gallery and created the GitHub prerelease; the installed module passed the full suite. -- 2026-10-05, overnight run (local branches): the 24 code defects of work - package 5 fixed with regression tests, plus what the reviews found: a - failed retry after taking ownership left the owner changed, and - `-PassThru` wrote objects after a failed change or under `-WhatIf`. - Maintainer decisions D2 to D5 (Decision 13), the issues #3, #4, #17, #74, - #86, and #88 fixed, the 37 open issues triaged, `Docs/FAQ.md`, Dependabot for - the actions, and the prerelease label `rc2`. One security review per PR; - every Major finding fixed. -- 2026-10-05, morning: the maintainer accepted the report's - recommendations. #5 (`Get-ChildItem2 -Attributes` matches any listed - attribute; an empty value is an error) and #82 (no `Size` alias) ship in - 5.0.0 as breaking changes on `ai/issue-fixes`. Tests at the top branch: - Windows PowerShell 423 passed, 26 skipped; PowerShell 7 394 passed, 55 - skipped (449). +- 2026-10-05, overnight run: the 24 code defects of work package 5 and the + issues #3, #4, #5, #17, #74, #82, #86, and #88 fixed with regression + tests, plus what one security review per PR found; the 37 open issues + triaged; `Docs/FAQ.md`, Dependabot for the actions, and the label `rc2`. + #5 and #82 are breaking changes, like the change of Decision 13. +- 2026-10-05: the first CI runs of the eight PRs found a defect that the + workstation had skipped, fixed in `629f4e7` (audit inheritance of an item + without a SACL). The PRs #99 to #106 were merged in order with merge + commits, CI on `master` passed, and the tag `5.0.0-rc2` published the + prerelease; GitHub's Actions outage that day cancelled the first two + attempts of the release run before they started. Repository hardening is + optional (Decision 14); the merge rule and the maintainer's rule for + fixes are Decisions 15 and 16. ## Stable capabilities @@ -48,37 +44,34 @@ version is still 4.2.6. descriptor (4), privileges (3), long-path items (6), links, hash, and disk space (5). - Works in Windows PowerShell 5.1 and PowerShell 7. In PowerShell 7, - `Get-FileHash2` lacks `RIPEMD160` and `MACTripleDES`, which .NET lacks - (on `master` it still fails there for every algorithm). + `Get-FileHash2` lacks `RIPEMD160` and `MACTripleDES`, which .NET lacks. - Pester tests in `Tests\` run in `$env:TEMP` sandboxes through `Tests\TestHelpers.psm1`; tests that need privileges skip without them and run in CI, whose runners are elevated. ## Open work -1. The maintainer pushes the eight branches, opens the PRs, merges them in - order, and tags `5.0.0-rc2` once CI on `master` is green; then tests - rc2. -2. Release 5.0.0 through CI (Decision 12) after the tests: remove the - label, date `[Unreleased]` as `[5.0.0]`, tag `5.0.0` (steps in - `Docs/Contributing/05-Releasing.md`; CI warns when the changelog date - isn't the release day). -3. Repository settings: the hardening proposed on 2026-10-04 isn't applied - yet (checked 2026-10-05); the maintainer applies it before pushing the - stack. The details are with the maintainer, not in the repository. -4. Open bugs from the triage: #34 and #67 (the write includes owner and - group; `fix/#34` swallows every error) for rc3 if a file server to test - against is available; #41 (a drive root reads the device object) and #90 - (a trailing space in a folder name) after 5.0.0. Enhancements: #22, #49, - #68, #77, #87. -5. `pwsh` 7.6.1 crashed three times during test runs on the ARM64 - workstation (x64 emulation) with an access violation in `coreclr.dll` or - `System.Management.Automation.dll`, without module frames; not - reproducible on demand. Check whether CI on native x64 shows it. -6. Minor review findings that the PRs list but don't fix, for example - `Copy-Item2 -WhatIf` reporting a destination conflict as an error, and - relative path forms that the `*-Item2` cmdlets resolve themselves; the - maintainer tracks the useful ones as issues. -7. Optional for the maintainer: delete the AppVeyor project and revoke its - GitHub authorization, restrict wiki editing to collaborators, and ask - `Sup3rlativ3` to delete the Read the Docs project. +1. Test 5.0.0-rc2, then release 5.0.0 through CI (Decision 12): remove the + label, date `[Unreleased]` as `[5.0.0]`, add `5.0.0-rc2` to + `$publishedVersions` in `Tests/Repository.Tests.ps1`, and tag `5.0.0` + (steps in `Docs/Contributing/05-Releasing.md`). +2. Issues: the open issues got their replies on 2026-10-05. Follow-up + issues for the open Minor review findings: #107 (relative path forms), + #108 (`Copy-Item2` and `Move-Item2`), #109 (error messages), #110 + (tests), and #111 (small items); #68 tracks `-WhatIf` and `-Confirm` for + every cmdlet that changes security, and #34 the copied inherited + entries. +3. 5.0.0-rc3, if a file server that refuses to assign the owner is + available for a test: #34 and #67. Every section of the security + descriptor is read and written, so the owner and group are written with + each change, and in an elevated session inherited entries are copied as + explicit ones; `fix/#34` swallows every error and needs a redo. After + 5.0.0: #41 (a drive root reads the device object) and #90 (a trailing + space in a folder name). Enhancements: #22, #49, #68, #77, #87. +4. `pwsh` 7.6.1 crashed three times during test runs on the ARM64 + workstation (x64 emulation), without module frames; none of the CI runs + on native x64 on 2026-10-05 crashed. +5. Optional for the maintainer: delete the AppVeyor project and revoke its + GitHub authorization, restrict wiki editing to collaborators, ask + `Sup3rlativ3` to delete the Read the Docs project, and delete the branch + `test/transfer`. diff --git a/.memory-bank/systemPatterns.md b/.memory-bank/systemPatterns.md index 264cbeb..2b5f57e 100644 --- a/.memory-bank/systemPatterns.md +++ b/.memory-bank/systemPatterns.md @@ -60,6 +60,9 @@ Each Decision record is a file in `decisions/`; read only the relevant ones. | 11 | [CI and the wiki run on GitHub Actions](decisions/0011-github-actions.md) | | 12 | [Releases are built and published by CI on a version tag](decisions/0012-ci-releases.md) | | 13 | [Set-NTFSInheritance keeps entries like the dedicated cmdlets](decisions/0013-set-inheritance-keeps-entries.md) | +| 14 | [Repository hardening is optional](decisions/0014-repository-hardening-optional.md) | +| 15 | [Merge stacked pull requests in order with merge commits](decisions/0015-merge-stacks-with-merge-commits.md) | +| 16 | [Fix only reproducible bugs](decisions/0016-fix-reproducible-bugs-only.md) | ## Patterns diff --git a/.memory-bank/techContext.md b/.memory-bank/techContext.md index d1ddc93..f2e0a5f 100644 --- a/.memory-bank/techContext.md +++ b/.memory-bank/techContext.md @@ -54,7 +54,7 @@ source: repository evidence in PowerShell 7.6 on 2026-10-04. Download the 0.2.0 package from `https://www.powershellgallery.com/api/v2/package/MarkdownLinkCheck/0.2.0` into `$env:TEMP`, extract it, and import it by path. -- The workstation is ARM64; PowerShell 7 runs as x64 under emulation. +- The first workstation is ARM64; PowerShell 7 runs as x64 under emulation. Python 3.12.10 (ARM64) is installed per user with winget, the maintainer's choice for an MkDocs check that Decision 9 made unnecessary. - The NuGet cache (`~\.nuget\packages`) holds every build dependency: copy @@ -62,23 +62,30 @@ source: repository evidence `microsoft.netframework.referenceassemblies.net452\1.0.3` into `packages\.`, and point `CscToolPath` at `microsoft.net.compilers\4.2.0\tools`. +- The second workstation (x64, used since 2026-10-05) runs the agent + session elevated, so the tests that need privileges run there as in CI. + It has no NuGet cache with these packages: download each from + `https://api.nuget.org/v3-flatcontainer///..nupkg`, + extract the first three into `packages\.` and the compilers + into `$env:TEMP`; Pester 5.7.1 comes from the Gallery package API the + same way, its folder first on `$env:PSModulePath` of the test process. + The GitHub CLI is in `C:\Program Files\GitHub CLI`, outside the PATH of + sessions started before its installation. ## Constraints -- `ModuleVersion` on `master` is `5.0.0` with the prerelease label `rc1` - (`ai/release-5.0.0-rc2` sets `rc2`); 5.0.0-rc1 is on the Gallery - (published 2026-10-04 by CI). The latest - stable tag and Gallery release is `4.2.6`. The manifest requires - PowerShell 5.1 and .NET Framework 4.5.2, uses `RootModule`, and lists - exactly 36 cmdlets; `Test-ModuleManifest` passes in Windows PowerShell 5.1 - and PowerShell 7.6. -- Besides the shipped help file and its tests (#93), the module source at - `master` differs from tag `4.2.6` by the `Remove-Item2 -PassThur` to - `-PassThru` rename (with a `-PassThur` alias), the manifest changes of - #95, and the assembly versions. +- `ModuleVersion` on `master` is `5.0.0` with the prerelease label `rc2`. + The latest stable tag and Gallery release is `4.2.6`. The manifest + requires PowerShell 5.1 and .NET Framework 4.5.2, uses `RootModule`, and + lists exactly 36 cmdlets; `Test-ModuleManifest` passes in Windows + PowerShell 5.1 and PowerShell 7.6. +- The module source at `master` differs from tag `4.2.6` by the changes + that `CHANGELOG.md` lists under `[Unreleased]`, the release notes of each + 5.0.0 prerelease. - PowerShell Gallery versions (publish dates): 4.0.0 (2015-08-19), 4.2.2 (2016-05-18), 4.2.3 (2016-05-19), 4.2.4 (2018-08-13), 4.2.5 (2019-07-11), - 4.2.6 (2019-07-12); none has release notes. Older versions were released + 4.2.6 (2019-07-12), none with release notes; 5.0.0-rc1 (2026-10-04) and + 5.0.0-rc2 (2026-10-05), published by CI. Older versions were released on CodePlex only, and their dates are lost. The git history starts on 2016-10-10, when the project moved from CodePlex. - Releases up to 4.2.6 had no script and no CI deployment: the Gallery @@ -106,7 +113,11 @@ source: repository evidence inside an agent command has no effect (verified 2026-10-04). The hook matches the whole command text, so a commit message that quotes such a command is blocked too. Prepare the commands and descriptions; the - maintainer runs them. + maintainer runs them. Give each command as one line, or as a script with + `-WhatIf`: the agent's question dialog renders Markdown, which joins the + lines of a block, and PowerShell then rejects all of it. Simulated `gh` + commands in offline tests must print what the real ones print, such as + the URL of a new comment. ## Validation