Skip to content

Allow the exact pinned source in convergence packaging - #1033

Open
GraciousGazelles wants to merge 5 commits into
mainfrom
fix/pinned-convergence-package-source-guard-20261112
Open

GraciousGazelles wants to merge 5 commits into
mainfrom
fix/pinned-convergence-package-source-guard-20261112

Conversation

@GraciousGazelles

Copy link
Copy Markdown
Collaborator

The existing convergence-package operation pins a single source SHA, tree, and upstream ancestor from its fixed branch, and runs only from protected main. A later generic ancestry check nevertheless requires that detached source to be an ancestor of the workflow host, making the approved source ineligible because it intentionally diverges from current main.

This changes only that final check: the exemption applies when the workflow has already selected the fixed convergence_package source. Ordinary package and pull-request paths keep the host-ancestry requirement. The exact branch/SHA/tree/upstream checks, clean generation, artifact identity/checksums, and same-run x86_64/AArch64 package-consumer checks remain unchanged.

No package artifact is published or installed by this change; after protected landing, the existing convergence-package workflow will validate the pinned source and consumer path.

@gemini-code-assist

Copy link
Copy Markdown

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant