From 0fd5a3eb8333ba95b3a1b7bdf605834cee988769 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 24 Aug 2026 10:20:29 +0500 Subject: [PATCH 1/2] fix(release): use the pinned public engine root --- CHANGELOG.md | 2 ++ core/app/release_operations.go | 7 ++++++- core/app/release_operations_test.go | 15 +++++++++++++++ 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 48bba1e..57b6483 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -40,6 +40,8 @@ Versioning. - Release sequence is an explicit monotonic dispatch input rather than the repository-local workflow run number, preserving the accepted sequence ledger across the public-authority migration. +- Release lifecycle operations invoked from a private control plane now bind + their committed implementation proof to its pinned public GDS engine root. ## [0.1.1] - 2026-08-16 diff --git a/core/app/release_operations.go b/core/app/release_operations.go index b61cc8c..71ff61c 100644 --- a/core/app/release_operations.go +++ b/core/app/release_operations.go @@ -15,6 +15,7 @@ import ( "github.com/NDDev-OpenNetwork/github-device-sync/core/domain" "github.com/NDDev-OpenNetwork/github-device-sync/core/identity" "github.com/NDDev-OpenNetwork/github-device-sync/core/operations" + "github.com/NDDev-OpenNetwork/github-device-sync/core/projections" "github.com/NDDev-OpenNetwork/github-device-sync/core/releaseconsumer" "github.com/NDDev-OpenNetwork/github-device-sync/core/serialization" "github.com/NDDev-OpenNetwork/github-device-sync/core/state" @@ -543,7 +544,7 @@ func (services *Services) releaseOperationContext( if err != nil { return releaseOperationContext{}, []domain.Finding{dependencyFinding(path, err)} } - if _, err := services.Git.CommittedSourceOID(ctx, root, []string{ + if _, err := services.Git.CommittedSourceOID(ctx, releaseImplementationRoot(root), []string{ "requirements/bundle-trust.yaml", ".github/workflows/release-bundle.yml", "scripts/validate_release.sh", "core/app/release_operations.go", "core/app/release_scope.go", "core/bundle", "core/cli", "core/cmd/gds", "core/operations", "core/providers/git/source.go", @@ -582,6 +583,10 @@ func (services *Services) releaseOperationContext( }, nil } +func releaseImplementationRoot(controlPlaneRoot string) string { + return projections.ResolveDevelopmentSourceLayout(controlPlaneRoot).EngineRoot +} + func (services *Services) releaseVerifier(identity bundle.TrustVerifier) (releaseconsumer.Verifier, error) { if services.ReleaseAttestations != nil { return releaseconsumer.Verifier{Schemas: services.Schemas, Attestations: services.ReleaseAttestations}, nil diff --git a/core/app/release_operations_test.go b/core/app/release_operations_test.go index 8957b14..4a169d8 100644 --- a/core/app/release_operations_test.go +++ b/core/app/release_operations_test.go @@ -1,6 +1,7 @@ package app import ( + "os" "path/filepath" "testing" ) @@ -28,3 +29,17 @@ func TestNormalizeReleaseOperationPathsProducesStableAbsoluteInputs(t *testing.T } } } + +func TestReleaseImplementationRootFollowsThePinnedPublicEngine(t *testing.T) { + root := t.TempDir() + if observed := releaseImplementationRoot(root); observed != root { + t.Fatalf("monolithic release root = %q, want %q", observed, root) + } + engine := filepath.Join(root, "modules", "github-device-sync") + if err := os.MkdirAll(engine, 0o755); err != nil { + t.Fatal(err) + } + if observed := releaseImplementationRoot(root); observed != engine { + t.Fatalf("split release root = %q, want pinned engine %q", observed, engine) + } +} From 180be786f0ef995e7e336b0ae8fe3dbbb78ecf32 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 24 Aug 2026 10:23:34 +0500 Subject: [PATCH 2/2] chore(gds): refresh the public release projection --- .gds/bundle.lock.yaml | 10 +++++----- .github/workflows/gds-ci.yml | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index 2478c4c..35b5a3d 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -5,14 +5,14 @@ bundle: version: "0.4.0-dev" release_sequence: 0 channel: "development" - source_tree_digest: "sha256:19faa612aeb7afbcd594c3b3e8ef1bec59f5639e73f1ecb8e63c7756d126144c" - digest: "sha256:6e9dccd59cc1fd5e89d0c7dfab833780599b6c66adf8baf112f3ceb5c3178258" + source_tree_digest: "sha256:989914f430e3575d2db2fd71fc8cdcf2313d08889fa2db32622d2d7966cbee60" + digest: "sha256:7308f18dfc57067fb30eab89058ddee635e554b149fbe2aa2eecf276eb4007b7" projection: - input_digest: "sha256:6c591644a111349d49e3b5d25e1418a14a74b0ca98891c75a8b39b9408f0d441" - output_digest: "sha256:7f3bb302ff5b46d9ddcf68765e3e05e12938ecdafe75a82b37313b75fdb87033" + input_digest: "sha256:43c3fa27e63fb7c3a2fde443d397f042d937a21aa868adab169a4cefdb088eed" + output_digest: "sha256:d9acac2455048c23dc2a1812b1eaa775b0e4862ef3ea9aa3998d11797786f297" files: - path: ".gds/compiled-policy.json" digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:165855583077fe66dfa6828017c7292c8dbd3fba173d259dffe1ffd59e6f6417" + digest: "sha256:4718a7cf5248d79660a3bbe952a158a4fe25672ec52948c5f2425fdb4cfbf3ec" diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml index 40140e1..c839777 100644 --- a/.github/workflows/gds-ci.yml +++ b/.github/workflows/gds-ci.yml @@ -1,8 +1,8 @@ # GENERATED FILE - DO NOT EDIT DIRECTLY # generator: gds # bundle: 0.4.0-dev -# source-tree-digest: sha256:19faa612aeb7afbcd594c3b3e8ef1bec59f5639e73f1ecb8e63c7756d126144c -# input-digest: sha256:6c591644a111349d49e3b5d25e1418a14a74b0ca98891c75a8b39b9408f0d441 +# source-tree-digest: sha256:989914f430e3575d2db2fd71fc8cdcf2313d08889fa2db32622d2d7966cbee60 +# input-digest: sha256:43c3fa27e63fb7c3a2fde443d397f042d937a21aa868adab169a4cefdb088eed # output-digest: sha256:8f61a9ffd6949238099d4523a037d57199eb575f187cc8ac52baa4b5b832e79f # edit-source: # - .gds/repository.yaml