FaceKom Release Automation — Design

A reusable, prepare-and-gate release workflow with an Obsidian tracking hub per release and a /fk-release <client> command. Validated on nusz (release issue ASSNUSZ-116 / FKITDEV-8938 → nusz-1.9.11.47).

Goal

Automate the client-release process “up to the gate”: collect scope from YouTrack, prepare branches/tags/release.json locally, then stop for explicit approval before any push or CI-firing tag. Track every release in Obsidian. Support both publish paths.

Decisions (locked 2026-06-15)

• Automation depth: prepare + gate — no push / CI-trigger without explicit approval.
• Scope source: the open ASS<CLIENT> “Release” issue (Package-linked members), readiness-checked by tag/status.
• Dual publish: 🅼 vuer-release → Harbor and 🅻 vuer_build → on-prem, both supported.
• YouTrack: read-only — post-release ticket transitions are manual.
• Rollback: fix-forward, never delete pushed tags.

Release model — shared core + routed publish

SHARED CORE (once)
  1. Scope     ready tickets (ASSNUSZ Release-issue manifest + tag/status)
  2. Merge     feature/FKITDEV-* → customization/<client>
  3. Changelog # <version>  (FKITDEV IDs)
  4. Tag SOURCE  vuer_oss + vuer_css → <client>-1.9.11.N   ◄── both paths build from this
        ├──🅼 vuer-release → Harbor : release/<M>/release.json → tag <client>@M → push → CI   [GATE before push]
        └──🅻 vuer_build → on-prem  : build.sh -b <tag> → sign-partner.sh   [GATE before build]

Scope determination (YouTrack)

• No Fix version field exists; release binding is a Package link to the ASS<CLIENT> “Release” issue (summary holds the version, e.g. “NÚSZ Release 1.9.11.47”). Open issue = current release; resolved = shipped.
• Readiness union (3 client-side-merged queries; cross-field OR unsupported): tag {Ready for release} ∪ CRNUSZ {CR Pipeline}: {Ready for Deployment} ∪ Blocker: {Release needed}, all #Unresolved.
• State taxonomy: CRNUSZ State + CR Pipeline (Ready for Deployment = deploy-ready; Approved ≠ ready); SLANUSZ/ASSNUSZ Issue Status + Blocker; BUGNUSZ archive-only.
• Shipped exclusion: resolved state + tag stripped; Blocker sticky → must AND #Unresolved.
• Customer ticket → implementation: Subtask/Resource link → FKITDEV-*. Merge-verify = FKITDEV Resolved AND its ID present in customization/<client> history.

Branch / tag structure (verified)

• customization/<client> overlay; feature/FKITDEV-* off it; update/customization/<client>-<date> core syncs.
• Source tag <client>-1.9.11.N on both vuer_oss + vuer_css.
• vuer-release: projects/<client>/release/<M>/release.json + tag <client>@M.
• Version rule: new content → bump source version + retag; rebuild-only → reuse version, new @M. Components for nusz are always vuer_oss + vuer_css; janus commit pinned constant.

Publish 🅼 — vuer-release (Harbor)

Copy prior release.json, bump VERSION/TAG, commit, tag <client>@M, push → .github/workflows/autobuild.yml on self-hosted runner builds + pushes to harbor.techteamer.com. Verify: Actions run + Harbor tag.

Publish 🅻 — vuer_build (legacy / on-prem)

Monolithic repo; per-client config in partner/<client>/; not tagged per release (stays on main). ./build.sh -b <client>-1.9.11.N (+ -bp -pw for encrypted ZIP) then ./sign-partner.sh -t <client>-1.9.11.N -k cosign.key. Consumes the same source tag. Needs operator keys (github.key SSH + cosign.key, both gitignored → git add -f). Builds native on the fk-dev Tailscale VM (command ssh ops@fk-dev.taild4189d.ts.net; Mac qemu fails — see dev-build-host; the old ssh Facekom box is decommissioned). Base images UBI8 (UBI10 on a feature branch). For nusz, ZIP packaging is OFF by default.

The /fk-release <client> [--target harbor|legacy|both] command

Reuses .claude/scripts/fkticket/client.py for YouTrack. Phases, each prepare-and-gate:

1. Scope — find open ASS<CLIENT> Release issue; collect Package-linked + tag/status union; reconcile + flag mismatches; derive version from the release-issue summary and next @M from vuer-release.
2. Hub sync — create/update the per-release Obsidian note.
3. Prepare (local) — verify FKITDEV merges; git ls-remote tips (narrowed-refspec aware); draft changelog; build release.json.
4. GATE — present plan/diff; await approval.
5. Cut (post-approval, each push confirmed) — tag vuer_oss+vuer_css; 🅼 release.json + tag <client>@M + push → CI; 🅻 build.sh + sign-partner.sh on fk-dev (dev-build-host).
6. Verify — Actions run + Harbor tag; update hub. (YouTrack stays read-only; post-release transitions are listed for manual action.)

Gotchas

• vuer_css narrowed fetch refspec → local refs stale; git ls-remote before any divergence/FF/push decision.
• vuer_build keys gitignored → git add -f; build native on fk-dev (command ssh ops@fk-dev.taild4189d.ts.net — plain ssh is shadowed by the kaku wrapper). ssh Facekom is decommissioned — dev-build-host.
• No auto-commit in code repos. Vault writes go through the obsidian CLI.
• Failed releases leave no trace → fix-forward, never delete pushed tags.

Deferred to next session

Build the /fk-release command + scripts (implementation plan forthcoming). This session delivered the tracking hub + this design.

Related

nusz-1.9.11.47 · release-process · youtrack-ready-for-release-nusz-query · FaceKom

Generalization — client registry & path detection

The system is client-generic. Names differ per system (YouTrack suffix ≠ repo name, e.g. RAFIPI=raiffeisen, MNET=magnet, PB=polgaribank), so /fk-release <client> resolves via client-registry. Build path auto-detected: modern (vuer-release/projects/<client>) / legacy (vuer_build/partner/<client>) / eSign (instacash). The ASS<CLIENT> Release-issue convention is universal (CIB at .101 proves it); version is per-client from that issue’s summary.

PR fetch (no YouTrack VCS)

YouTrack has no VCS integration (VcsChangeCategory empty everywhere). PR resolution chain: payload ticket → FKITDEV impl ticket (YouTrack Subtask/Resource link) → PR via (a) git log --all --grep=FKITDEV-NNNN merge-commit (#NNNN → github.com/TechTeamer/<repo>/pull/NNNN) and (b) scanning ticket comments for pasted PR URLs. Best-effort — some tickets carry no code (estimate/screenshot tasks).

Comment extraction (tests etc.)

Fetch /api/issues/<id>/comments?fields=text,author,created,attachments. No is-test flag → rank by: (1) has attachment (strongest test-artifact signal), (2) Hungarian QA keywords (tesztel*, UAT, PROD, eltérés, nem stimmel, nem oldotta meg, rendben, stat, riport, hiba, Release needed), (3) embedded YouTrack issue links. Copy top-ranked verbatim into the hub per-ticket. Attachment URLs are signed/expiring.