Toolkit 1.0.3 reached all three live products within an hour of release

Every product pins the toolkit in one line, and a release does nothing until a product changes the version in that line. Until 19 October 2026 that was manual: a release meant editing the pin in each product and finding out from each product's pipeline whether it still built.

Two scripts, before and after the release

factory/check_consumers.py takes every active product in the factory registry that pins the toolkit and builds it against a toolkit checkout instead of the published packages, before anything is released. factory/propose_upgrade.py then opens the upgrade merge request in every product that pins an older version. It changes the pin and nothing else, and each merge request's description carries the changelog sections of every version newer than the product's pin, so whoever merges sees what the product must act on.

Toolkit 1.0.3 removed the one place where a package referenced one in a higher layer: Tenancy.Runtime no longer depends on Organizations.Api. It also pins the Stripe library to an exact version. Before release, check_consumers.py built all five products against the change.

The timeline on 19 October

The 19 packages of 1.0.3 were published at 16:00 UTC. The first real run of propose_upgrade.py pushed the branches to Gostly, MojRazpis and SnapMind but opened no merge requests: it took the source project from the directory it ran in. The fix creates them through the API by project name and lets a rerun finish what a failed run started; the rerun opened the three at 16:04. Reputo and Leadgener took the release in merge requests of their own, together with the delivery kit's new security scans. All five were merged by 16:09.

Production deploys are still a button the owner presses. MojRazpis and SnapMind ran 1.0.3 in production from 16:39, and Gostly, whose changes go to its development branch first, from 16:54. From publishing to the last production deploy took 54 minutes, and the factory registry records the release with the date it reached every live product.

Nothing made the five move together: each merge request ran its own pipeline, and a product that leaves its merge request open stays on its old pin. Version 1.0.3 was not a security release. A security fix will take the same path: built against every product first, then proposed to each of them.