base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Validate CI module tags before delivery preparation

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-01 19:27:56 +00:00
parent 9376bafaa2
commit 078db6cbcb
4 changed files with 83 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/cli.md
View File

@@ -244,9 +244,11 @@ verifies the tag, HEAD, and clean worktree. With `--prepared`, it performs those
checks read-only against the existing checkout and does not fetch or check out.
In either mode, it loads the profile from the verified source. `--expected-module`
optionally checks that the profile selects the module chosen by a launcher;
module selection itself remains profile-owned. The command validates explicit
forge selection and resolves the configured token. For binary profiles, it
performs a read-only repository preflight before downloading application
module selection itself remains profile-owned. The command compares the selected
module's derived release tag with the full event tag before forge access or
dependency preparation, then validates explicit forge selection and resolves
the configured token. For binary profiles, it performs a read-only repository
preflight before downloading application
dependencies; delivery performs a fresh check after dependency preparation.
Source-only profiles rely on delivery's automatic preflight and skip dependency
downloads and binary builds.

10
docs/roadmap/remediation.md
View File

@@ -197,7 +197,15 @@ cleanup; this finding does not require removing plans now.
## 5. Bind CI release identity before online preflight and preparation — P2
Status: open.
Status: complete.
**Completed:** CI now derives the selected module identity from the verified
event commit and checks the complete tag before credential loading, forge
requests, or dependency preparation. The optional launcher-module guard and
delivery's later source/preflight verification retain their responsibilities.
A focused page-only/binary regression covers a matching launcher selection
with a mismatched derived tag and verifies no forge or Go-tool work. That test
and existing valid CI/preflight/managed-delivery tests passed.
**Evidence:** [CI adapter](../../cmd/releasekit/main.go), especially
`runCIDelivery` and `checkExpectedModule`, and the existing identity/tag checks