Repository navigation
promote.yml: slsa-build runs where the rung reads the release artifact (unblocks #740); workflow-rules R16 - #750
Closed
MattJackson wants to merge 3 commits into
Closed
MattJackson wants to merge 3 commits into
MattJackson wants to merge 3 commits into
Conversation
…tifact (needs_release_artifact), so the predev->dev pull request's shards download an artifact this run built
…only where it is built; RED-armed by the #740 regression (slsa-build back to merge-group-only)
promote into
|
MattJackson
added this pull request to the merge queue
Oct 10, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to a conflict with the base branch
Oct 10, 2026
…fact-download rule renumbered R17; predev's engine-pin rule keeps R16)
Collaborator
Author
|
Closed by busbar-release (DEAD): Superseded by #754. The branch is bundled at /Users/matthew/Library/Caches/busbar-release/branch-snapshots/2026-10-11/busbar.bundle. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks #740 (promote predev into dev, DEV-GREEN).
Cause. Every #740 run since #743 failed the same way: all four hop shards stop at
actions/download-artifactwith "Artifact not found for name: slsa-artifact-", and the fold calls the missing shard reports INFRA:ours. The dev rung (ladder.json: oracle + conformance, absolute) makes the preflight writeneeds_release_artifact=true. That makes each shard wait forslsa-build(ci turnstile await-job), then downloadslsa-artifact-${SHA}from its own run. Butslsa-buildwas gated tomerge_group, so in a pull request into dev it was skipped.await-jobtreats a skipped job as green ("await-job:slsa-buildis green"), so the download ran against an artifact that could never exist. The "digest-mismatch: error" lines are just the action's echoed default input, not a second failure.Fix.
promote.yml:slsa-buildnow runs onrun == '1' && (merge_group || needs_release_artifact == 'true'). A run that judges a promotion builds the release artifact of exactly the commit it promotes, in that same run. The engine is still downloaded and sha256-pinned, and slsa-build is still contents-read only. The engine's R6 wiring check (jobs.slsa-build.ifcontainsrun == '1') still holds.workflow-rulesR16 (new row, RED-armed): a step that downloadsslsa-artifact-*from its own run must be reachable only where a job of that run uploads it. That means it either waits on the builder's success, or the builder's event-narrowedif:admits the step's condition. Selftest mutation: putslsa-buildback to merge-group-only. Unit tests cover the promote predev into dev #740 shape, the fixed shape, the soak's wait-on-success spelling, an unconditional download, an orphan download, andrun-id:downloads.