Implement the manual release procedure for reproducing milestone
releases locally when Argo Workflows in iad-ci is degraded or
unavailable. This is the PB-13 fallback documented in the plan
(line 567) for the R13 risk register entry.
The runbook includes:
- Prerequisites (hardware, tools, cross-compilation toolchains)
- OpenBao secret paths for all release credentials
- 13-step release procedure covering:
1. Tag verification
2. Full CI suite run
3. Cross-compilation for 5 target triples × 2 feature variants
4. Binary verification
5. SHA-256 checksum generation
6. GPG signing of checksums
7. Python wheel building (maturin)
8. PyPI upload
9. crates.io publishing (pdftract-core → pdftract-cli order)
10. GitHub Release creation
11. mdBook building
12. Cloudflare Pages deployment
13. SLSA Level 2 attestation generation
- Failure mode recovery procedures (triple build failure,
PyPI upload failure, SLSA attestation failure)
- Idempotency and safe re-run rules per step
- Completion criteria (all channels must succeed)
- Continuity plan (written for a stranger)
Acceptance criteria:
- docs/operations/manual-release.md exists with all required sections
- Step-by-step procedure complete (all 13 steps)
- Manual release CHANGELOG record template present
- Failure modes documented for the three most likely partial failures
- Runbook is verbatim-executable by a non-author release lead
Closes: pdftract-4sj0
85863a244b