chore(devops): add a script that files the production release requests on Orbit

[AntonioVentilii]

Motivation

Filing a production release is a long manual sequence: check out the tag, hash .env.production, then for each of the four canisters build in docker and file the Orbit request, copying the request id and batch id out of the terminal as they scroll by. It takes hours, most of it unattended, and the payoff is a Slack message whose values must all be transcribed by hand. A mistyped batch id or a stale ENV_SHA sends every reviewer down the wrong path.

Changes

• Add scripts/prod.release.sh, which drives the whole sequence against the oisy-prod station and prints the release announcement at the end, ready to paste.
• Preflight before anything slow: docker running, dfx-orbit installed, active station matches the production station id, the identity reaches it, working tree clean.
• Prompts for the .env.production hash confirmation, then the tag (defaulting to the latest, which it names), then a checkbox picker for the canisters to release.
• Builds and files one canister at a time, because every docker-build.* script wipes its output directory first. Output is tee'd to a per-target log with elapsed times.
• Stops on the first failing build or request, and reports which requests are already open on production so they can be cancelled if the release is abandoned. A command that exits 0 without printing a request id or batch id is treated as a failure rather than silently producing an incomplete message.
• Records ids per tag under ~/.oisy-release/<tag>/, outside the repo so a release never builds a dirty tree. Re-running the same tag pre-deselects what is already filed; --targets none only re-renders the message.
• Copies itself to a temp file and re-execs before touching git, since checking out the release tag would otherwise rewrite the script underneath the running shell. This also makes it work for tags that predate it.

The script only ever requests. It never approves, and it posts nothing.

Tests

Verified against the v2.5.6 release that was filed manually today:

• Preflight, env hash prompt, tag resolution and default, resume detection, and message rendering all exercised locally. Rendering was checked by seeding the real v2.5.6 request and batch ids and comparing the output to the message that was actually posted.
• --help, shfmt -i 2 -d, shellcheck, bash -n, plus ./scripts/lint.sh.sh and ./scripts/format.sh.sh --check.

Not covered: the build and request loop itself, including the id parsing and the failure paths, since exercising those means filing real requests on production. The parsers match the exact Created request: <uuid> and Batch id: <n> lines that dfx-orbit 0.10.0 prints. Next release is the real test, and the resume support means a parsing miss costs one target rather than the whole run.

Draft until it has driven a release end to end.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 52bdf1e.

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/00881019-f162-4503-9567-953b0be667d7?scanId=005cc9eb-3237-46d5-913c-803dead6cda8&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► scripts/prod.release.sh     Add production release automation script for Orbit (new file)

[Copilot]

🟡 Changes recommended

The new script has confirmed portability and safety issues (non-portable date -r, untracked-files cleanliness check weakening reproducibility, and unquoted state exports that are later sourced).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new DevOps helper script to automate filing OISY production release requests in Orbit (including preflight checks, interactive target selection, resumable state, per-target logs, and generating a ready-to-paste Slack announcement).

Changes:

• Introduces scripts/prod.release.sh to build selected canisters in Docker and file Orbit requests sequentially.
• Adds resumable state under ~/.oisy-release/<tag>/ to skip already-filed targets and re-render announcements.
• Renders a Slack announcement including request URLs, review commands, and release arguments.

File summaries

File	Description
scripts/prod.release.sh	New production release automation script: preflight, interactive selection, build/request loop, resumable state, and Slack message rendering.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[AntonioVentilii]

Tested twice for release v2.5.6 and all went smoothly, working in successful interactions.

[DenysKarmazynDFINITY]

nice!