Skip to content

ci(release): verify release provenance for backfill publishes #447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
beardthelion wants to merge 23 commits into
base: main
Choose a base branch
from
+1,134 −42
Open

ci(release): verify release provenance for backfill publishes #447

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
6514037
ci(release): gate publish jobs on the release environment, anchor the…
beardthelion Sep 13, 2026
7ef1b9c
ci(release): qualify tag checkouts and keep moving tags forward-only
beardthelion Sep 13, 2026
7b8e182
ci(release): gate every job on the release environment and verify tag…
beardthelion Sep 13, 2026
a219ed1
ci(release): qualify the provenance compare and fail closed on npm lo…
beardthelion Sep 13, 2026
0742c67
ci(release): check release author, decide npm dist-tag per package, c…
beardthelion Sep 13, 2026
7d9b6e1
ci(release): anchor docker moving tags to the registry floor, not the…
beardthelion Sep 13, 2026
e005dda
ci(release): require backfill release assets to be automation-uploaded
beardthelion Sep 13, 2026
ab0a32e
ci(release): pin the verified commit and the exact asset bytes end to…
beardthelion Sep 13, 2026
1a9f51f
ci(release): run the resolver on the producer path and hash homebrew …
beardthelion Sep 13, 2026
73d560e
ci(release): bind the tag to the commit its release was created against
beardthelion Sep 13, 2026
64c4ea5
ci(release): force bash for the release-binaries resolver step
beardthelion Sep 13, 2026
55a6a2a
ci(release): base64 release-asset names in the resolver map
beardthelion Sep 13, 2026
7c88dc2
Address PR review feedback (#447)
beardthelion Sep 13, 2026
7c33483
Address PR review feedback (#447)
beardthelion Sep 13, 2026
c55fec5
ci(release): freeze docker moving tags on dispatch, retire the regist…
beardthelion Sep 13, 2026
57968b0
ci(release): make the resolver test's gh stub discriminate on the ful…
beardthelion Sep 13, 2026
d02bb32
ci(release): assert the pinned npm version took effect
beardthelion Sep 13, 2026
c5d2dbc
ci(release): surface missing-asset errors from the formula sha() subs…
beardthelion Sep 13, 2026
13a1fff
ci(release): consume resolver outputs instead of release-please outpu…
beardthelion Sep 13, 2026
e455db1
ci(release): document the concurrency group's pending-slot replacement
beardthelion Sep 13, 2026
ef4d29a
ci(release): share the image output and bound the step scanners to jobs
beardthelion Sep 13, 2026
d2d6660
ci(release): close the review-found evasions in the release checks
beardthelion Sep 13, 2026
2f04ac1
ci(release): floor the moving tags against the releases list
beardthelion Sep 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Loading