v1.0 tag-cut: CI gates — e2e wiring, tag-lineage, SLSA sdist (Day 2)#18
v1.0 tag-cut: CI gates — e2e wiring, tag-lineage, SLSA sdist (Day 2)#18tachyon-beep wants to merge 1 commit into
Conversation
TEST-01 (clarion-23e78a6e75): Add sprint_2_mcp_surface.sh to the walking-skeleton job in ci.yml and the verify job in release.yml. CARGO_BUILD=0 so the binary built earlier in the same job is reused. TEST-02 (clarion-fdc0d695f4): Add phase3_subsystems.sh to the same jobs with the same CARGO_BUILD=0 pattern. CI-01 (clarion-6a622d5f7e): Add an "Assert tagged commit is on main" step at the top of the release.yml verify job, guarded by `if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')` so workflow_dispatch dry-runs from feature branches are unaffected. CI-03 (clarion-f530101222): Extend the release-subjects glob to include clarion_plugin_python*.tar.gz alongside clarion-*.tar.gz, covering the Python sdist in SLSA provenance. Rename the output variable to release-subjects and provenance file to clarion-release-artifacts.intoto.jsonl to reflect the broader scope. Verified locally: - YAML syntax: python yaml.safe_load passes both files - sprint_2_mcp_surface.sh: PASS (CARGO_BUILD=0 with existing binary) - phase3_subsystems.sh: PASS - CI-01 ancestor check: git merge-base --is-ancestor HEAD origin/main correctly returns 1 on this feature branch (expected) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
Closes several “Day 2” CI/release gating gaps for the v1.0 tag-cut workflows by wiring additional E2E checks into CI/release verify, enforcing tag lineage against main, and broadening SLSA provenance subjects to include the Python plugin sdist.
Changes:
- Add a release-time guard to assert
v*tags point to a commit reachable fromorigin/main. - Wire
sprint_2_mcp_surface.shandphase3_subsystems.shinto both CI and releaseverifygates (withCARGO_BUILD=0reuse). - Expand SLSA subject derivation from Rust archives only to “release artifacts” (Rust + Python plugin sdist), and rename provenance/outputs accordingly.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/release.yml | Adds tag-lineage check in verify, wires new E2E gates, and broadens/renames SLSA subject/provenance inputs/outputs. |
| .github/workflows/ci.yml | Adds Sprint 2 MCP-surface and Phase 3 subsystem determinism E2E steps to the walking-skeleton job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') | ||
| run: | | ||
| git fetch --no-tags origin main | ||
| git merge-base --is-ancestor "$GITHUB_SHA" origin/main || \ | ||
| { echo "::error::tag $GITHUB_REF does not point to a commit on main"; exit 1; } |
|
Superseded by the Day-2 consolidation onto |
Summary
Closes four Day 2 CI gaps from the v1.0 gap register.
clarion-23e78a6e75):sprint_2_mcp_surface.shwired intowalking-skeleton(ci.yml) andverify(release.yml). UsesCARGO_BUILD=0— binary built earlier in the same job bysprint_1_walking_skeleton.sh.clarion-fdc0d695f4):phase3_subsystems.shwired with the same pattern.clarion-6a622d5f7e): Tag-lineage ancestor check added as the first step after checkout inrelease.yml verify. Guarded byif: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')soworkflow_dispatchdry-runs from feature branches are no-ops.clarion-f530101222): SLSArelease-subjectsglob extended fromclarion-*.tar.gzto also matchclarion_plugin_python*.tar.gz. Output variable renamedrelease-subjects(wasrust-subjects) and provenance file renamedclarion-release-artifacts.intoto.jsonl(wasclarion-rust-binaries.intoto.jsonl) to reflect the broader scope.Verification
python -c "import yaml; yaml.safe_load(open(...))"passes both files.sprint_2_mcp_surface.sh: PASS locally withCARGO_BUILD=0.phase3_subsystems.sh: PASS locally.git merge-base --is-ancestor HEAD origin/maincorrectly returns exit 1 on this feature branch (non-ancestor), confirming the check fires; theif:guard makes it a no-op except on real tag pushes.Architectural notes
sprint_2_mcp_surface.shfailure observed during the initial local run was a transient partial pip installation (~larion-plugin-pythoninvalid distribution) in the local venv — not a script or CI bug. The script is clean; CI environments get a fresh install.-oalternation infindrather than a secondfind | catpipeline, so the sort order is deterministic and the base64 subject list is stable across runs.if:guard on CI-01 is the mechanism that makesworkflow_dispatchsafe on non-main branches; removing it would break the standard dry-run pattern documented inrelease.ymlline 15.🤖 Generated with Claude Code