REL-1.8.0-PREP-01: Prepare Thoth v1.8.0 release

[ja573]

Task identity

• Task ID: REL-1.8.0-PREP-01
• Repository: thoth-pub/thoth
• Parent coordination: IMPORT-ORCID-PERF-01: Restore bounded contributor resolution for bulk import #850 (IMPORT-ORCID-PERF-01)
• Released feature source: API-IMPORT-ORCID-BATCH-01: Add exact batch contributor lookup by ORCID #851 / PR API-IMPORT-ORCID-BATCH-01: Add exact batch contributor lookup by ORCID #860 (API-IMPORT-ORCID-BATCH-01)
• Release-line CI prerequisite: CTRL-CI-CLIPPY-MASTER-01: Propagate Clippy 1.98 baseline repair to master #861 / PR CTRL-CI-CLIPPY-MASTER-01: Propagate Clippy 1.98 baseline repair to master #862 (completed)
• Risk: MEDIUM - release identity/version preparation; no runtime activation
• Exact authorized base: master @ ce478426328559549327e87db9b58f76f624b94c
• Branch: release/v1.8.0
• PR target: master
• PR state: DRAFT until independent exact-head review and separate merge authorization

Objective

Prepare the already-merged ORCID batch API hotfix for a Thoth v1.8.0 release using the established v1.7.0 release-preparation pattern, without tagging, publishing a GitHub Release, deploying, activating, or reconciling master -> develop.

The release is a minor version because the release line adds the new backwards-compatible public GraphQL field contributorsByOrcids.

CTO reports the currently live production version is 1.7.0; deployment is explicitly CTO-owned and outside this task.

Approved release contents

At the exact authorized base, CHANGELOG.md contains two current Unreleased entries only:

• API-IMPORT-ORCID-BATCH-01 under ### Added;
• CTRL-CI-CLIPPY-MASTER-01 under ### Fixed.

This task must cut those existing entries into:

## [Unreleased]

## [[1.8.0]](https://github.com/thoth-pub/thoth/releases/tag/v1.8.0) - 2026-08-29

with the existing ### Added and ### Fixed sections/entry text preserved byte-for-byte apart from their placement beneath the new 1.8.0 heading. Unreleased remains empty.

Version bump

Following the established v1.7.0 pattern, change the Thoth workspace release version from 1.7.0 to 1.8.0 consistently in:

• root Cargo.toml package version;
• each workspace member Cargo.toml package version;
• every exact internal workspace dependency pin =1.7.0 -> =1.8.0;
• Cargo.lock entries for the Thoth workspace packages.

No third-party dependency/version change is permitted.

Authorized write paths

Only these existing files may change:

• CHANGELOG.md
• Cargo.toml
• Cargo.lock
• thoth-api/Cargo.toml
• thoth-api-server/Cargo.toml
• thoth-client/Cargo.toml
• thoth-errors/Cargo.toml
• thoth-export-server/Cargo.toml

No new file is required by this release-preparation task.

Non-goals / invariants

Do not change:

• Rust implementation source or GraphQL/schema behaviour;
• migrations or migration SQL;
• authentication/authorization;
• workflows/toolchain configuration;
• external dependencies;
• Metrics source/contracts or feature/metrics;
• infrastructure/runtime/provider state;
• release/tag state;
• develop.

This task must not alter the already-reviewed ORCID API implementation or the Clippy repair inherited on master.

Metrics cross-programme dependency

feature/metrics currently has an independently approved checkpoint at e3fa9c7dfd68512d400dcd5dd6051e9648f5b568 and contains two Metrics migration directories whose release suffix is currently v1.8.0:

• thoth-api/migrations/20260826_v1.8.0/
• thoth-api/migrations/20260827_v1.8.0/

Because v1.8.0 is now selected/reserved for this hotfix release, Metrics must reconcile those migration release suffixes and any semantically linked Metrics release-version references to v1.9.0 before Metrics final integration/release. That reconciliation is not part of this task and must be handled under the Metrics programme with its own bounded implementation/review gate. A programme-level note is to be recorded on #766.

Acceptance / validation

Before handback:

1. Reverify live master remains exactly ce478426328559549327e87db9b58f76f624b94c before branch creation.
2. Create release/v1.8.0 from that exact SHA; STOP if the branch already exists or master moved.
3. git diff shows only the eight authorized existing paths above.
4. CHANGELOG.md contains empty Unreleased, then the dated 1.8.0 heading, with the two release entries otherwise unchanged.
5. Every Thoth workspace package version and exact internal pin is 1.8.0; no third-party dependency version changes.
6. Cargo.lock is consistent with the manifest bump only.
7. Run at minimum:
   • cargo metadata --no-deps --format-version 1 and verify all workspace package versions are 1.8.0;
   • cargo check --workspace --locked;
   • cargo test --workspace;
   • cargo fmt --all -- --check;
   • cargo clippy --all --all-targets --all-features -- -D warnings;
   • git diff --check.
8. Commit and push only the bounded release-preparation changes.
9. Open one DRAFT PR release/v1.8.0 -> master and allow normal automatic PR CI and the existing GHCR staging-PR publication side effect.
10. Stop for independent exact-head review. Do not mark ready or merge.

CTO implementation authorization

The CTO explicitly authorized, on 2026-08-29, creation of this issue and bounded implementation from exact master @ ce478426328559549327e87db9b58f76f624b94c, limited to the release cut and workspace 1.7.0 -> 1.8.0 version bump described above. Authorized actions are:

• create release/v1.8.0 from the exact authorized base;
• edit only the authorized existing paths;
• create the bounded release-preparation commit(s);
• push the task branch by ordinary non-force update;
• create one DRAFT PR to master;
• permit normal automatic PR CI and GHCR staging-PR publication.

Explicitly not authorized:

• merge or ready-for-review transition;
• tag creation;
• GitHub Release creation/publication;
• production image publication via release event;
• manual CI dispatch/rerun/cancel;
• production deployment or activation;
• infrastructure/provider mutation;
• credential work;
• migration execution outside normal automatic CI classification;
• master -> develop reconciliation;
• any Metrics source mutation;
• branch deletion.

If the exact base moves, the write scope expands, release contents differ from the two approved Unreleased entries, or validation reveals an unrelated problem, HOLD rather than broadening scope.

Current gate

IMPLEMENTATION AUTHORIZED FROM master ce478426328559549327e87db9b58f76f624b94c - AWAITING BOUNDED release/v1.8.0 IMPLEMENTATION / DRAFT PR / CI

Refs #850
Refs #851
Refs #861
Refs #766

[ja573]

Independent source review - APPROVED

Task: REL-1.8.0-PREP-01
Owning issue: #864
PR: #866
Risk: MEDIUM
Reviewer: GPT-5.6 Sol (independent of the implementation agent)

Exact reviewed source

• Authorized base / live master: ce478426328559549327e87db9b58f76f624b94c
• Reviewed PR head: 56c3be8c1916635804721b66a3825a5d28c789a6
• PR state at review: OPEN / DRAFT / unmerged
• Branch: release/v1.8.0 -> master

This approval is bound to exact head 56c3be8c1916635804721b66a3825a5d28c789a6. Any new source commit invalidates it and requires fresh independent review.

Source review

The actual master...HEAD diff is bounded to the eight authorized existing paths only:

• CHANGELOG.md
• Cargo.lock
• Cargo.toml
• thoth-api-server/Cargo.toml
• thoth-api/Cargo.toml
• thoth-client/Cargo.toml
• thoth-errors/Cargo.toml
• thoth-export-server/Cargo.toml

Findings:

• CHANGELOG.md adds only the dated v1.8.0 release heading beneath empty Unreleased; the approved API-IMPORT-ORCID-BATCH-01 and CTRL-CI-CLIPPY-MASTER-01 entries and historical release content remain unchanged.
• All six Thoth workspace package versions move 1.7.0 -> 1.8.0 consistently.
• Exact internal Thoth dependency pins move =1.7.0 -> =1.8.0 consistently.
• Cargo.lock changes only the six Thoth workspace package version lines; no third-party dependency or resolution change was introduced.
• No Rust implementation source, GraphQL/schema behaviour, migration, auth, workflow/toolchain, infrastructure/runtime, Metrics source, or develop change is present.
• The two-commit lineage is correctly rooted at the exact authorized base.

The implementation agent's local worktree limitation for the root package / thoth-export-server is closed by PR CI, which exercises the full workspace with the required test database environment.

Exact-head CI / side-effect evidence

All automatic runs associated with reviewed head 56c3be8c1916635804721b66a3825a5d28c789a6 are terminal:

• check-changelog run 33239215697: SUCCESS
• run-migrations run 33239215694: SUCCESS; run_migrations job SKIPPED (no migration change)
• build-test-and-check run 33239215747: SUCCESS
  • build: SUCCESS
  • full-workspace tests: SUCCESS
  • format: SUCCESS
  • Clippy/lint: SUCCESS
• PR staging image workflow 33239215703: SUCCESS
  • build_and_push_staging_docker_image: SUCCESS

The staging image is the already-authorized automatic PR staging-pr-* side effect; it is not production/release publication or deployment.

Decision

APPROVED - exact reviewed source 56c3be8c1916635804721b66a3825a5d28c789a6 satisfies the approved REL-1.8.0-PREP-01 specification with no blocking finding.

This approval does not authorize: ready-for-review transition, merge, tag creation, GitHub Release creation/publication, production image publication, deployment/activation, manual CI mutation, branch deletion, master -> develop reconciliation, or Metrics mutation.

Current gate

INDEPENDENT SOURCE REVIEW APPROVED @ 56c3be8c1916635804721b66a3825a5d28c789a6 - AWAITING EXPLICIT CTO SHA-BOUND MERGE AUTHORIZATION

[ja573]

Release reconciliation - v1.8.0 published and repository-side release observation complete

Release preparation task #864 is now reconciled against live authoritative state.

Merge

• PR REL-1.8.0-PREP-01: Prepare Thoth v1.8.0 release #866: MERGED / CLOSED
• reviewed source head: 56c3be8c1916635804721b66a3825a5d28c789a6
• merge commit / current release commit: 9ae1e56714096507d2d210b5b315361d626626c9
• merge parents: prior master @ ce478426328559549327e87db9b58f76f624b94c + reviewed REL-1.8.0-PREP-01: Prepare Thoth v1.8.0 release #866 head
• merge tree: 7ee27360ee549820728a7077a1aa1fdb7329b98c
• merge commit is GitHub-signed/verified.

Post-merge CI on exact master

• build-test-and-check run 33240516742: COMPLETED / SUCCESS; build, full-workspace tests, formatting and Clippy all succeeded.
• run-migrations run 33240516746: COMPLETED / SUCCESS; migration classification succeeded and actual run_migrations execution was SKIPPED.

Tag and release

• annotated tag: v1.8.0
• tag object: 9dd196dd35b64ee10621b426fe2a311af3cd8083
• peeled commit: exactly 9ae1e56714096507d2d210b5b315361d626626c9
• tag object is unsigned; this is recorded rather than inferred as signed.
• GitHub Release ID 378909354: PUBLISHED, non-draft, non-prerelease, at 2026-08-29T07:29:06Z.
• release notes contain the approved API-IMPORT-ORCID-BATCH-01 Added entry and CTRL-CI-CLIPPY-MASTER-01 Fixed entry.

Release image publication

Release event workflow 33240945781 on exact head 9ae1e56714096507d2d210b5b315361d626626c9 is COMPLETED / SUCCESS. Job 99070070151 completed the build/push and image-digest steps successfully.

This records repository image publication only. Production deployment/activation is CTO-owned and explicitly outside this task; no deployment claim is made here.

Forward reconciliation

The separately bounded v1.8.0 -> develop task is now #867 (REL-1.8.0-DEV-RECON-01), authorized from exact develop @ 665583371e0bbb64bf2d71836b4ce1a73e57d3a2 using exact released tag v1.8.0 / peeled commit 9ae1e56714096507d2d210b5b315361d626626c9. Merge to develop itself remains a later independent-review/authorization gate.

Decision

REL-1.8.0-PREP-01: COMPLETE - MERGED / TAGGED / RELEASE PUBLISHED / RELEASE IMAGE PUBLICATION GREEN

#864 can close completed. Deployment and master -> develop integration are separate controls.