Repository navigation
Correct draft visibility and prepare fresh 0.4.2 packages - #8
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 0.4.1 release run passed all three actual compiled native builds but its final job could not read the prepared unpublished draft. GitHub draft visibility requires push-capable credentials. Give only that main-only manual verifier contents-write visibility, retaining actions/security read scopes and a read-only verifier command that cannot publish or overwrite assets.
Require the actual final job's exact scope set and literal field layout. Real-workflow regressions reject reduced draft visibility, extra/expanded scopes, commented/duplicate mappings, expression values and duplicate whole permission blocks; the existing integrated CLI check still permits metadata reads only and preserves the draft. Trusted-main review remains primary; this is a narrow workflow-format contract rather than a general YAML parser.
Prepare a coherent fresh 0.4.2 product/runtime/UI/Python/npm/worker/installer identity. Preserve the 0.4.1 draft, all its assets and all published 0.4.0 history. No application algorithm, account/vault/consent schema or UI workflow change is introduced beyond version/display/matching worker-image identity. Approved Office editions remain unchanged snapshots of accepted7d runtime source.
Validation: 286 tests plus28subtests,85.12% coverage with the unchanged80%floor; Ruff;87 source maps; strict TypeScript/Vite build; exact existing Office-byte/source/link checks. The freshly frozen and compiled0.4.2 Windows application passed6.3s with real account/editor/privacy/lock, coherent version/worker provenance, numeric drain/sealing and owned-process disappearance. Local package is an unsigned dirty development build. Independent Cyber review is clear. All four npm metadata files differ only at product/root version; dependency graphs are unchanged.
The public CI report preserves the actual failure boundary and explicitly states no specific HTTP status was retained. Actual fresh provider visibility, exact-main full CodeQL, three-OS native and owner downloaded-installer acceptance remain pending gates; no historical failure is relabeled as success. No release/asset/tag or installed-user state was mutated.