Record the v0.6.0 promotion bindings from the first green release run - #240
Merged
Conversation
…een release run The three artifact-dependent bindings were left blank when the promotion record was written, because release.yml had never completed a run and filling them from a local build would have manufactured the evidence the record exists to bind. Run 33325655578 on tag v0.6.0 is the first green run of that workflow in the project's history: preflight, both cli-draft-artifacts targets, both ethos-full candidates, and the Windows verify-only draft. The source commit, artifact names, and SHA256 values are taken from it. Each checksum was recomputed from the downloaded archive and compared with the .sha256 sidecar the run published. The record says plainly that this is weaker than it looks, because the sidecar is generated in the same workflow step as the archive, so it verifies transport rather than provenance; what binds provenance is the source commit and the run. The binaries report `ethos 0.6.0`, from the run's smoke evidence and from executing the extracted macOS binary directly. Windows is excluded explicitly. The run produces ethos-windows-x64.zip from the verify-only lane, and Windows packaged artifacts remain in blocked_lanes, so this record does not authorize it. Also recorded: every inventory sidecar still reads draft_not_release_ready / blocked, because write_release_artifact_inventory.py hard-codes both and cannot describe an approved artifact. The record states that the promotion state lives here, not in the sidecar. make release-gates exits 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: docushell-dev <hello@docushell.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fills the three artifact-dependent bindings left blank in
docs/validation/v0-6-0-release-promotion.md.Run 33325655578 on tag
v0.6.0is the first greenrelease.ymlrun in the project's history — preflight, bothcli-draft-artifactstargets, bothethos-fullcandidates, and the Windows verify-only draft.8adda91ethos-macos-arm64.tar.gz,ethos-linux-x64.tar.gz, bothethos-full-0.6.0-*required_files12when unsetBinaries report
ethos 0.6.0, confirmed from smoke evidence and by executing the extracted macOS binary.Stated honestly in the record: comparing a checksum against a sidecar generated in the same workflow step verifies transport, not provenance. What binds provenance is the source commit and the run.
Windows is excluded. The run produces
ethos-windows-x64.zipfrom the verify-only lane; Windows packaged artifacts stay inblocked_lanes.Inventories still say blocked.
write_release_artifact_inventory.pyhard-codesdraft_not_release_ready/blockedand cannot describe an approved artifact. The record notes that promotion state lives in the record, not the sidecar.make release-gatesexits 0.🤖 Generated with Claude Code