Repository navigation
Conversation
…nifests.yaml Bumps [devantler-tech/.github/.github/workflows/publish-manifests.yaml](https://github.com/devantler-tech/.github) from 10.0.3 to 12.0.1. - [Release notes](https://github.com/devantler-tech/.github/releases) - [Commits](0f39032...6f1dee9) --- updated-dependencies: - dependency-name: devantler-tech/.github/.github/workflows/publish-manifests.yaml dependency-version: 12.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
![botantler-1[bot]](https://avatars.githubusercontent.com/in/1025824?s=60&v=4){kind=small}
Code coverage overviewLanguages: Go Go / code-coverage/test
Go / code-coverage/go
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
Signed-off-by: Nikolai Emil Damm <nikolaiemildamm@icloud.com>
Pull request was converted to draft
devantler
changed the title
Publisher update review, v10.0.3 → v12.0.1: read every release note in the range (v10.0.4, v10.0.5, v10.1.0, v10.2.0, v10.2.1, v11.0.0, v12.0.0, v12.0.1), the current catalogue/publication guides, and the full source comparison. The separate actions changelog is historical; no additional current migration guide is published. The eight announced changes are: configuration publishing through the approved publisher (already adopted); singleton admission retirement (already adopted); recovery publisher command and default-off recovery workflow (repository-owned and already adopted); Go-cache observer recovery (not used by this manifests-only call); retirement of the catalogue-only .NET workflow (not used by this call); repository ownership of release recovery (already adopted, no removed export is called); and withdrawal of legacy Actions management (already adopted). No new publisher workaround or capability adoption is needed. The two major removals do not affect the selected manifests interface. The complete publisher workflow and both scripts it copies have identical Git blobs and regular-file modes at the old and new publisher commits: workflow ce9a9897b154486218478734a02c61e5ac3ea479, absence helper 3566e4067e953a1d9cb34e6a50a0f9b72a5d8bc8, recovery helper 48dc38f60ddebf90b0976758df9f1983bbb86bfd. The caller verifier and signed-promotion opt-ins remain enabled. The deployed approved-revision check remains an independent publication gate. Issue #727 repair: the updated caller reproducibly failed the old test; the repaired promotion suite passes with the original signing, failure-ordering, immutable-version and recovery controls intact. The real new guard also accepts unchanged releases from a shallow consumer, refuses changed workflow/helper contents and modes, and refuses malformed references or missing publication controls. Repository baseline validation and all eight other local publication safety suites pass; native registry/cryptographic hosted proof remains to be collected at the pushed head. Correctness, simplification and security self-review found no unresolved findings. |
@coderabbitai full review |
|
|
Important Review skippedThis PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again. ⚙️ Run configuration
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
CodeRabbit declined this request because the bot author has no assigned review seat. The complete current-head artifact guard reports ADMIT: no substantive review or finding was published. The required CI and product admission passed at this head; review proceeds to Codex. The PR stays draft while semantic review and native scanner ingestion remain pending. |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness at User evaluation: I inspected native job 120366680796 at this exact head. It exercises the actual updated caller, accepts unchanged publisher releases, rejects changed workflow/helper bytes and modes, and preserves signed-claim, digest, late-version and partial-publication refusals against disposable cryptographic/registry fixtures. All those assertions pass. This is the exercisable publishing contract; no production publication is claimed. The scanner-only recovery of job 120365769783 completed as run 39939048059 attempt 2 at the unchanged head. Native analysis 2012970773 has no processing error, and the zizmor check now succeeds with no new alerts. The earlier completed-neutral result was insufficient and did not authorize promotion. The published body passes the repository template contract. Source activity is outside the ownership window and the local holder check reports none. The PR is ready for promotion; rebind readiness again before protected merge. |
Why
Routine publisher updates are blocked because a safety test requires an older release, even when the publishing behavior is unchanged.
What
Update the publisher and accept new releases only when their publishing contents remain approved. Preserve publication safeguards and reject changed or unverifiable publishers.
Fixes #727