[lklimek]

TL;DR: Document how to contribute and release Tenderdash for Dash Platform, with a reviewed release process and preparation for one integration branch.

User story

As a Dash Platform maintainer, I want release versions and support expectations to reflect the changes being shipped and the networks using them.

As a contributor, I want current development, validation and review instructions so that I can prepare a change for integration.

Scenario

Base flow

Maintainers prepare a Tenderdash update for Dash Platform and decide how to release it safely.

Actual behavior

Documentation promises independent support across release lines, and release automation infers versions from branch names and commit labels. Development checks depend on versioned branch names. Contributor guidance includes obsolete build, testing and review instructions.

Expected behavior

Support follows Dash Platform needs. A project release skill reviews the actual changes and compatibility before selecting a version, while development checks support the planned dev branch. Contributors receive a practical guide grounded in observed development and release history.

Detailed discussion

What was done

• Reposition README and security/contribution/release guidance around Dash Platform, with dev for integration and master for released code.
• Rewrite CONTRIBUTING.md end to end: explain the Gitflow adaptation from observed integration, release-promotion, hotfix and forward-merge behavior; cover current build/BLS, focused checks, generated files, docs, dependencies, stacked PRs and the live PR Hygiene process. Separate the selected candidate SHA from the final reviewed release commit and document dev as integration and master as stable.
• Align the related AGENTS.md review-trigger instruction with the supported claudius-review label.
• Remove temporary integration-branch guidance from README, CONTRIBUTING, AGENTS, RELEASES and the project release skill; documentation and examples use dev.
• Share one canonical .agents/skills/tenderdash-release/SKILL.md between Codex and Claude Code through the .claude/skills/tenderdash-release directory symlink; Claude Code invokes /tenderdash-release.
• Add .agents/skills/tenderdash-release with actual history/net-diff SemVer review, stable hotfix isolation, reachable published baselines, frozen candidate SHAs, independent protocol versions, and coordinated Platform rollout.
• Replace branch-inferred release automation and stale GoReleaser configuration with read-only evidence collection and an explicit local signed-artifact builder. Preserve Linux amd64/arm64 binary signatures and archives; add checksums and source provenance. The existing Docker publication workflow remains in place.
• Prepare CI and local lint-base selection for dev. Repurpose release CI to test the helpers without publication permissions.
• Remove the unused Mergify configuration and its merge-queue wording from the contributor guide; authorized maintainers merge under repository protections.

This is preparatory: no branch rename, protection change, release, or tag mutation. Maintainers must reconcile master's linear-history rule with the planned full-release promotion before release publication. Rename and default-branch changes remain separate operational steps.

Testing

Twelve isolated release scenarios and local-gate scenarios pass, including misleading commit labels, reverted changes, equivalent backports, hotfix isolation, frozen candidates after development advances, and signed-artifact orchestration. Independent synthetic forward-testing confirmed the frozen SHA excludes newer unreviewed changes and retains lineage guards without mutations.

Ruff checks/formatting, ShellCheck, shell syntax, project-skill validation, workflow syntax, and whitespace checks pass. Full actionlint reports only the existing check-generated.yml SC2155 issue, reproduced on the base. Markdown lint passes for the rewritten CONTRIBUTING.md; pre-existing AGENTS list indentation remains. No Go runtime files changed. Real Docker builds, signing keys, and external publication were not exercised; artifact orchestration uses isolated mocks.

The contributor guide was checked against a 90-day first-parent history and 12 representative merged PRs, including ancestry/patch checks for squash merges and release/hotfix propagation. Independent fact-checking, Markdown lint, 39 local path/fragment checks across the updated guides and Makefile command dry-runs pass. Runtime tests were not repeated for the documentation-only rewrite.

A read-only Mergify audit found no eligible open PRs, no Mergify merger among the latest 30 merged PRs, and no Mergify check/status activity on six representative PR heads. Repository reference scanning, contributor-guide Markdown lint and whitespace checks pass after removal.

Breaking changes

The old scripts/release/release.sh CLI and GoReleaser publication entry point are removed. Maintainers must use the project release skill and its explicit helpers. This changes the maintainer workflow; no Go, wire, or runtime configuration contract changes in this PR.

Attribution

Release archives include the root license and applicable root/database attribution files from the exact reviewed source revision. Component notices remain optional until the local database package is present. Twelve isolated release tests pass, including byte-for-byte archive notice checks for both architectures and exclusion of unreviewed working-copy edits; scoped Python, shell, and Markdown checks also pass. Docker/GPG execution remains mocked in these tests.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

PR Hygiene · f7ff476

• Bots — thepastaclaw skipped by lklimek
• Self-review — posted; again after any push
• Build green
• Approvals — you own every area touched; none needed

When every merge requirement is met, the PR Hygiene check passes. Reviewer limits do not block merging; other required GitHub checks and protections still apply.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: dashpay/tenderdash
• Branch: chore/dev-release-workflow
• File: .coderabbit.yaml
• Commit: f7ff476
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 69a63285-c7cc-46c8-b71d-6690448fb88f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[thepastaclaw]

⛔ Final review complete — 1 blocking finding(s) (commit f7ff476)

[github-actions]

Waiting for bot review — thepastaclaw not yet. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

[thepastaclaw]

Final validation — Phase 1 + Phase 2

The release helpers and CI migration are consistent with the planned single integration branch, but the contributor guide now requires origin/dev before that remote branch exists, breaking its fresh-checkout and lint instructions. Static verification found one actionable documentation blocker; current CI reports successful release-tooling, build, test, E2E, lint, and generated-code checks, with only PR Hygiene pending. No local builds or tests were run.

🔴 1 blocking

Review provenance

Source: reviewer 1: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: general); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: normal by gpt-6.1-sol (effort low) — The cross-cutting release tooling, artifact-building scripts, tests, and CI changes alter behavior beyond documentation but do not directly change a qualifying critical surface.
• Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer
• Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity quota lookup failed), glm-5.3-flash (not used above high effort; tier asks max)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort high); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `CONTRIBUTING.md`:
- [BLOCKING] CONTRIBUTING.md:60-65: Checkout instruction targets non-existent origin/dev
  The fresh-checkout procedure fails at `git switch -c my-change origin/dev`: a live `git ls-remote --heads origin dev v1.8-dev v1.9-dev` returns the two versioned branches but no `dev`. The example at line 92 also explicitly passes `LINT_BASE=origin/dev`, bypassing the Makefile's working migration fallback. This PR introduces these instructions while explicitly leaving the branch rename to a separate operational step, so contributors cannot follow the guide when it lands. Document `origin/v1.8-dev` as the current integration ref until the rename, or show branch selection that prefers `origin/dev` and falls back to `origin/v1.8-dev`; keep the planned final branch model clearly distinguished from commands that work today.

[github-actions]

Your move: thepastaclaw requested changes on this head; dismiss the review or push a fix.
Full checklist in the description.

PR describes state after switching to new repo layout. I'll rename the base branch just after merging this PR.

[github-actions]

Waiting for bot review — thepastaclaw not yet. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

[lklimek]

/skip-bots

[lklimek]

/self-reviewed

[github-actions]

Bots are done — your move: post /self-reviewed.
Full checklist in the description.

[github-actions]

Policy satisfied — this can merge.
Full checklist in the description.