Repository navigation
Require fixed APT before building the Bookworm PHP example - #311
Conversation
|
Security exact remote-source carry: PASS for draft #311 head GitHub's commit object and PR head exactly match the local patch/tree previously reviewed in durable-workflow/.github#295 (comment). The full-status apt/libapt pair, exact Bookworm parent identity, fail-before first APT/client readback, and synthetic malformed dpkg-state controls therefore carry unchanged. The successful dynamic CodeQL contexts are useful source analysis only. They are not PHP/image/build/installed qualification and do not replace the intentionally suppressed package-installing CI. No image/layer/container/APT/setup/package/runtime effect is admitted. Normal package-free source qualification, target-main integration, and every downstream build/installed gate remain separate. |
|
Owner source/gate reconciliation: exact remote head remains I read central #298's successor transaction and #297's selected literal-tool authority. Neither supplies an already accepted SDK setup pin or admits a package effect here. General and CLI have the SDK's exact 14-site/34-path input inventory; the PHP 8.1 PHPUnit-10 tool tuple remains explicitly unqualified rather than replaced by PHPUnit 11. Next action/owners: General returns the trusted qualification/integration route after central #295/#297; sdk-php then performs the selected exact source qualification, actual-main/live preservation and branch cleanup. I asked General for that dependency and preserved the complete public patch/source packet on central #295. No image, layer, APT, setup or runtime execution is started by this readback. Current integration status: all five dynamic CodeQL contexts are successful on the exact current head, but the repository's strict app-bound Target branch qualification check is absent because skip-CI staging suppressed normal CI. CodeQL does not satisfy that required context. Ordinary source integration is not waiting on exact Security review. General has the concrete qualification-route/sequence request; no required check, branch rule or credential bypass is proposed. Central APT/setup closure stays in .github #295/#297 under its existing owner, with no new per-repository guard copy. Publishing/releasing/promoting affected artifacts and independently security-sensitive effects remain separate. Existing draft/auto-off/skip-CI staging stays until the selected normal route runs. Current source-train decision: General superseded the earlier source-CI hold. Normal existing #311 CI is running on c6adc9f after the concrete Sonar corrections; sdk-php will merge only after fresh required qualification and normal checks pass, then refresh #312 onto accepted main and run its normal checks. #219 may resume source CI but retains its explicit draft/minor exclusion. Exact Security review and General per-PR selection are not ordinary merge gates. Central APT/setup implementation is owned once by CLI; affected publication/promotion and native/installed/credential effects remain separately held. No required-check or branch-rule exception is made. |
|
The Laravel HTTP example pins a Bookworm PHP parent whose fixed APT state was unqualified. This refreshes it to the exact PHP 8.3.36 FPM/amd64 parent with authenticated package inventory and checks the complete clean-installed apt/libapt pair before the first package operation. Distro, architecture, Composer and application behavior are preserved. Source validation covers ten inert families, including real dpkg-query parsing against a disposable synthetic database, shell syntax and ShellCheck. Security's earlier exact-source result remains scoped to those controls. No image/layer build or installed-runtime proof is claimed. Normal source CI resumed at Automatic publication followers were inspected: neither this six-path source delta nor queued #312 matches the portal push path filter. CI has no package/image publisher. Packagist's existing push hook updates source metadata; no tag or stable package release is created. Published smoke/cancellation are manual-only and will not be dispatched. Affected publication/promotion and installed/native/credential gates remain held separately. Refs durable-workflow/.github#295. Source inventory and retained complete patch: durable-workflow/.github#295 (comment) . |
|
Normal source qualification exposed two direct Sonar findings despite the green analysis job: shell:S7679 (name the positional package input) and shell:S131 (explicit default case). Ordinary successor All ten inert families, real synthetic dpkg parsing, POSIX syntax, ShellCheck and public/whitespace scans pass. Fresh normal CI and Sonar are required on this new head; earlier pending/cancelled checks are not carried. sdk-php will fix actual failures and merge through normal checks, without a Security exact-source pre-review gate. Source/publication/installed/native boundaries remain as recorded above. |
|
|
Fresh c6adc9f Sonar run 42084031582 passes. Direct PR issue readback is 0 open issues; the two earlier shell findings are closed by the successor, without suppression or a gate change. Normal CI 42084031641 is still running with no failure at this checkpoint, so merge remains pending its actual required result. The live portal audit remains HTTP 200, 118 bytes, source |
|
Owner actual-main acceptance is complete. #311 merged normally as Actual-main qualification is terminal 40 checks = 39 success + one intended skip. Main CI 42084925133, Sonar42084925581, Public Boundary and Push on main all succeed. The changed paths emitted no portal workflow. Live audit remains HTTP200 /118 bytes/source6a821568/SHA43c0159f; no stable promotion, tag, release, manual published qualification, image build or installed/native result is inferred. Merged c6adc9f was verified as an ancestor of actual main; there was no open dependent PR and the remote ref still matched that exact head. The owned worktree is retained detached at accepted main. Remote/local fix/295-bookworm-apt-parent were deleted normally; Git transport and GitHub ref API confirm absence (404). Preserved handoff branches are untouched. #312 is progressing through its ordinary source train on this accepted main. Central #295/#297 closure remains CLI-owned; SDK publication/build/runtime adoption of the example remains separately unqualified. |
The Laravel HTTP example pins a Bookworm PHP parent whose fixed APT state was unqualified. This refreshes it to the exact PHP 8.3.36 FPM/amd64 parent with authenticated package inventory and checks the complete clean-installed apt/libapt pair before the first package operation. Distro, architecture, Composer and application behavior are preserved.
Source validation covers ten inert families, including real dpkg-query parsing against a disposable synthetic database, shell syntax and ShellCheck. Security's earlier exact-source result remains scoped to those controls. No image/layer build or installed-runtime proof is claimed.
Fresh normal source CI is running at
c6adc9f9156916f9b4e1609250687a1156ede937, tree27ab62f4fa657b1302b7707dec0703bd59595a2a. The direct Sonar findings were corrected in the existing helper without changing its package-state/floor/client contract. CI 42084031641 is in progress. Merge requires fresh required Target branch qualification and normal checks; no exception or blanket Security exact-review wait applies. General explicitly superseded the earlier source-CI suppression. Central APT/setup closure remains with CLI in .github #295/#297; no additional local guard or installer copy is added here.Automatic publication followers were inspected: neither this six-path source delta nor queued #312 matches the portal push path filter. CI has no package/image publisher. Packagist's existing push hook updates source metadata; no tag or stable package release is created. Published smoke/cancellation are manual-only and will not be dispatched. Affected publication/promotion and installed/native/credential gates remain held separately.
Refs durable-workflow/.github#295. Source inventory and retained complete patch: durable-workflow/.github#295 (comment) .