openregs bump

Open the release-bump pull request in a consuming repository.

Move a consuming repository’s pinned release forward by one release, on a branch, with the impact report as the request body. The pin is the release: field of that repository’s own controls.yaml — the file already states which corpus its atom ids were written against — and a bump rewrites that one line, preserving every comment around it, then re-parses the file and refuses the bump if anything else moved. The branch is cut from a temporary clone and pushed to the repository’s remote, so the caller’s working tree is never touched; turning that branch into a pull request (gh pr create) or a merge request (git push -o merge_request.create) belongs to the CI integration that calls this. Exits 1 when an atom the mapping maps to a control changed SUBSTANTIVELY, which is openregs impact’s contract unchanged, so the check is red exactly when the bump needs a control owner before it merges.

openregs bump [-h] [--repo <path>] --to <regime>@<tag> [--map <path>] [--from <registry>]
                     [--corpus <path>] [--trust <path>] [--remote <url>] [--base <branch>]
                     [--branch <name>] [--out <dir>] [--push-option <option>] [--no-push]

Option
--repo <path>	the consuming repository’s checkout; its origin is where the branch is pushed (default .)
--to <regime>@<tag>	the release to pin to, for example fixreg@2025.04 (required)
--map <path>	the mapping to bump and report against, relative to the repository root (default: controls.yaml). It is also the pin file: its release: field is the pin (default controls.yaml)
--from <registry>	pull the release from this registry and verify it — signatures, digests, provenance, log inclusion — before anything is read from it. Without this, the release is read from —corpus
--corpus <path>	a checkout holding the release under regimes/<regime>/releases/<tag>/. Defaults to the checkout this command is running from
--trust <path>	the trust roster —from is verified against (default: the checkout’s config/)
--remote <url>	push the branch here instead of the repository’s origin
--base <branch>	the branch the bump is cut from and opened against (default: main) (default main)
--branch <name>	the branch to open (default: openregs/bump-<regime>-<tag>)
--out <dir>	where the four output files are written (default: .openregs/): impact.json, pull-request.md, pull-request-title.txt, verdict.txt (default .openregs)
--push-option <option>	a git push option, repeatable. This is how a GitLab pipeline opens the merge request: —push-option merge_request.create (repeatable)
--no-push	prepare the branch and the report without pushing anything (a dry run)