[DO NOT MERGE] demo: prove the new channel preflight catches the change that broke the release - #58
Closed
HuggeK wants to merge 2 commits into
Closed
[DO NOT MERGE] demo: prove the new channel preflight catches the change that broke the release#58HuggeK wants to merge 2 commits into
HuggeK wants to merge 2 commits into
Conversation
The signed channel refuses to republish changed artifact bytes under a version it has already published. That is the rule that makes a version name a set of bytes an operator can pin, and it was the one release check no pull request could run: asking it needs the published channel, so it only ever ran from the release job on main. srcfl#53 merged with five green checks and took the release down; the repair had to be a second pull request against a main that was already broken. Nothing about the question needs the signing key. The published manifest is a public release asset, its signature verifies with the public key already in the workflow, and the bytes a driver would publish as come from the tree. So check-versions builds the artifacts in memory, signs nothing, and answers what the release would answer -- on every pull request, forks included, since a fork needs no secret to read a public asset. _version_collisions is now the single statement of the rule. Both the release and the check read it, because a rule stated twice drifts, and a check that drifts from the release is worse than no check at all: test_check_versions_answers_what_the_release_would_answer holds them to the same verdict on the same tree. The check reports every colliding driver rather than the first, each with the bump_driver command that fixes it. The release still stops at one; it has nothing else to do, and someone fixing a branch wants the list. test_check_versions_catches_a_manifest_only_edit is srcfl#53 in the shape it arrived in -- a manifest field corrected, no Lua touched, the published bytes moved anyway. Verified against the live channel as well: the current main passes, and replaying that edit is refused before a merge. CONTRIBUTING no longer says this fails only after the merge, and carries the command to ask it locally. It also states the one sharp edge: the comparison is against the published channel, not against main, so a main that is itself unpublishable fails this on unrelated pull requests until it is fixed. Signed-off-by: Hugo Karlsson <48095810+HuggeK@users.noreply.github.com> Co-authored-by: HuggeK <48095810+HuggeK@users.noreply.github.com>
…aught Not for merge. This is srcfl#53 in the shape it merged in: nibe_local's ders moved, no Lua touched, the version left at the published one, and index.yaml, devices.yaml and the support status regenerated so every check that existed at the time still passes. The expected result is that only the new signed-channel job fails. Signed-off-by: Hugo Karlsson <48095810+HuggeK@users.noreply.github.com> Co-authored-by: HuggeK <48095810+HuggeK@users.noreply.github.com>
Collaborator
Author
|
Proof captured — closing as planned. All five pre-existing checks passed (exactly as they did on #53) and only That is the gap #57 closes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Throwaway proof for #57 — not for merge, will be closed as soon as the checks report.
This reconstructs #53 in the shape it merged in:
nibe_local'sdersmoved, no Lua touched, the version left at the one already published, andindex.yaml/devices.yaml/ the support status regenerated — so every check that existed at the time passes, exactly as they did then.Expected: every pre-existing check green, and only
signed channel accepts this treered. That is the gap #57 closes.Note this PR is stacked on #57, so it carries that branch's commit as well.