Release and support reference

Release gates and support#

The source version is 1.8.0, with extension API 1. Additive starter templates and a persistent administrator launch checklist help forum owners prepare their communities. The optional official-community module adds manual access-fulfillment tracking, private notifications with opt-in email, and customer-story submission/publication with explicit revocable consent. Repository access remains manual. Existing forums and permissions are preserved when applying starter templates. Exact-SHA CI and rollout evidence belongs to the phase release record.

Supported targets are PHP 8.4, Composer 2, and MySQL 8.4/9.7 LTS. SQLite is a development test target. MariaDB and other server versions have not been certified. No paid support, response-time guarantee or long-term support window is promised for this release. Report reproducible bugs through the repository's GitHub issues; include the version, environment, steps and redacted logs. Never publish credentials, application keys, private uploads, database dumps or recovery bundles. Report suspected vulnerabilities privately to the repository maintainer before disclosing exploit details publicly.

Build and verify a distribution#

From a Git checkout with Composer dependencies installed, stage/commit every intended source file, then run:

npm ci && npm run build
php scripts/build-release.php
php scripts/verify-release.php artifacts/voltexahub-1.8.0.zip /new/private/release-check

The builder includes tracked application/source files and generated public/build assets. Untracked uploads, fixtures, local tools, dependencies and runtime state are excluded. It rejects linked source files and excludes environment secrets, database dumps, keys and caches. Review tracked content before building: filename guards cannot detect a credential embedded in an otherwise legitimate source file. The ZIP has a SHA-256 sidecar for download integrity; checksums alone do not authenticate the publisher. Extract into a new directory and follow installation. Node and development dependencies are unnecessary on the destination.

CI runs the PHP suite against SQLite and both supported MySQL versions. Each MySQL job builds and validates the archive, independently installs production Composer dependencies into the extracted archive, installs a synthetic community, verifies installer repetition, administrator/guest permissions, /up, and homepage compiled assets. It then installs the actual Phase 1 code 0975030986f44d6316eea4d6a3a1679fed432e58, captures synthetic account/discussion/membership state and an upload, applies the archive migrations and bundled-plugin upgrade, and checks retained state and HTTP behavior. No target asset rebuild is performed. Uploaded CI artifacts include the archive and checksum only, never fixture databases or state snapshots.

scripts/release-smoke.php is a CI/local rehearsal utility for isolated synthetic databases only. Its state snapshot includes password hashes; keep it private and temporary. The archive validator checks paths, secret filenames and all manifest assets before extraction. CI execution is evidence only after the relevant run succeeds; a configured workflow alone is not a passed check.

Final release checklist#

Use the phase tracker, 6A, and phase 6 release record to link exact results. Existing 4A installation/recovery drills, 4B security and 4C performance/accessibility evidence applies to unchanged behavior. A final release requires successful CI for the released SHA, its archive/upgrade gates, reviewed version/install/support/recovery docs, and exact-SHA Railway web/worker/product deployment, migrations and live health checks. Run affected browser flows when changes warrant them. Release archives are verified source distributions requiring Composer, not bundled vendor installations.

Back up the database, private uploads and original APP_KEY together before upgrading. Follow operations, including an isolated matching-code restore for rollback. The automated upgrade gate complements the 4A recovery/rollback rehearsal; it does not replace an operator's backup or prove compatibility with every third-party extension.