stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Build release bundles from the declared Git commit #1044

New Issue
Closed
opened 2026-08-17 22:20:35 +00:00 by timmy · 0 comments
timmy commented 2026-08-17 22:20:35 +00:00
Owner
Copy Link

Problem

scripts/build_release.py labels artifacts with --commit but recursively reads the ambient working tree. Test-generated bytecode, ignored files, untracked local data, or tracked modifications can therefore enter an artifact that claims to represent a different commit. A test-polluted audit build contained 58 __pycache__/.pyc members and grew from the published clean RC's 439,304 bytes to 990,431 bytes.

Historical issue #44 only stopped tracked bytecode from dirtying worktrees, and #339 added deterministic archives/checksums without binding member bytes to the declared Git tree. No open issue or recent commit implements commit-derived release membership.

Acceptance criteria

  • Resolve and validate the exact declared commit in the source repository.
  • Select the runtime allowlist from tracked files in that commit and read member bytes/modes from the Git object database, not the working tree.
  • Unknown commits and commits missing required runtime members fail closed.
  • Ignored bytecode, untracked sentinels/secrets, and tracked-but-uncommitted modifications cannot affect artifacts.
  • Building the same commit from clean and polluted worktrees produces byte-identical archive, manifest, and checksum outputs.
  • Verification compares archive membership and bytes with the declared commit and rejects generated/cache members.
  • CI release promotion runs provenance verification before publication.
  • Focused and full test suites pass.

Product impact

Operators can prove every shipped runtime byte came from the tagged commit, while release size and contents no longer depend on prior test execution or local worktree state.

## Problem `scripts/build_release.py` labels artifacts with `--commit` but recursively reads the ambient working tree. Test-generated bytecode, ignored files, untracked local data, or tracked modifications can therefore enter an artifact that claims to represent a different commit. A test-polluted audit build contained 58 `__pycache__`/`.pyc` members and grew from the published clean RC's 439,304 bytes to 990,431 bytes. Historical issue #44 only stopped tracked bytecode from dirtying worktrees, and #339 added deterministic archives/checksums without binding member bytes to the declared Git tree. No open issue or recent commit implements commit-derived release membership. ## Acceptance criteria - Resolve and validate the exact declared commit in the source repository. - Select the runtime allowlist from tracked files in that commit and read member bytes/modes from the Git object database, not the working tree. - Unknown commits and commits missing required runtime members fail closed. - Ignored bytecode, untracked sentinels/secrets, and tracked-but-uncommitted modifications cannot affect artifacts. - Building the same commit from clean and polluted worktrees produces byte-identical archive, manifest, and checksum outputs. - Verification compares archive membership and bytes with the declared commit and rejects generated/cache members. - CI release promotion runs provenance verification before publication. - Focused and full test suites pass. ## Product impact Operators can prove every shipped runtime byte came from the tagged commit, while release size and contents no longer depend on prior test execution or local worktree state.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1044
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?