Gate release candidates on tested, verifiable artifacts #340

timmy · 2026-08-08T20:36:29Z

timmy commented

2026-08-08 20:36:29 +00:00

Closes #339

What changed

build one reproducible runtime bundle with per-file provenance, a public manifest, and SHA-256 checksum
verify the downloaded artifact and exact commit before any release API mutation
gate promotion on test + package jobs, upload all three assets to a draft RC, then publish
remove the independent release workflow and stale static manifest

Verification

python3 -m pytest tests/ -q — 630 passed
production bundle built and verified locally; tamper regression test fails closed

Closes #339 ## What changed - build one reproducible runtime bundle with per-file provenance, a public manifest, and SHA-256 checksum - verify the downloaded artifact and exact commit before any release API mutation - gate promotion on test + package jobs, upload all three assets to a draft RC, then publish - remove the independent release workflow and stale static manifest ## Verification - `python3 -m pytest tests/ -q` — 630 passed - production bundle built and verified locally; tamper regression test fails closed

timmy added 1 commit 2026-08-08 20:36:29 +00:00

ci: gate RCs on verifiable artifacts (#339 )

CI / lint (pull_request) Successful in 33s

Details

CI / build-release (pull_request) Successful in 4s

Details

CI / release-candidate (pull_request) Has been skipped

Details

2cb92811c9

timmy merged commit 5d326c30a1 into main

2026-08-08 20:37:36 +00:00

timmy referenced this issue from a commit