Skip to content

Define shared GitHub-first artifact recovery policy - #126

Merged
ORESoftware merged 3 commits into
mainfrom
hardening/github-first-recovery-policy
Sep 14, 2026
Merged

ORESoftware merged 3 commits into
mainfrom
hardening/github-first-recovery-policy

Conversation

@ORESoftware

Copy link
Copy Markdown
Contributor

Centralizes the outage-recovery locator order in the interface authority instead of requiring each client to privately sort artifact_locators().

After the normal registry path has failed, artifact_recovery_locators() returns:

  1. GitHub Release assets
  2. GitHub Packages / GHCR
  3. GitHub tag archive
  4. optional R2/CDN

Registry locators are omitted because this function is specifically the post-registry recovery contract. The historical artifact_locators() inventory/order is left unchanged for compatibility.

Two focused Rust tests lock the cross-client invariant and prove disabled GitHub surfaces are not silently re-enabled.

This is the shared-authority companion to zed-pkg/zed-cli#388. Once this lands, that PR should consume zed_interfaces::artifact_recovery_locators and delete its local source_fallback_priority / github_first_locators duplicate.

@ORESoftware
ORESoftware merged commit bb0f3fe into main Sep 14, 2026
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant