Repository navigation
ci: add the protected release workflow (package, verify, approval-gated publish) - #7
Merged
Merged
Conversation
…ksum rules tools/ci_release.py derives tag, archive and checksum names (reproducing the four published releases), refuses anything but a full commit SHA and a clean tree, builds with the pinned published CLI and public SDK through ci_bootstrap, assembles the bootstrap resources and packs twice to require byte-identical archives. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ed identity The first local run stopped with a bare StopIteration because the artifact is named crt-cli-<host>. The executable is now the artifact whose bytes equal the verified stage-2 digest, and the SDK is the directory named by the summary's version and content hash; zero or ambiguous matches are controlled errors with unit tests. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…val-gated publish release.yml (manual) builds exactly a requested commit that is on main and has a passing CI gate, packs a deterministic archive, verifies it on a separate runner (including a real GitHub SDK acquisition and the C and C++ workflows) and publishes only through the `release` environment, which requires a reviewer. publish is the only job with contents: write; it re-checks the digest, stages a draft, compares the downloaded draft byte for byte and refuses an existing tag. dry_run (default) stops at the verified draft. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds release.yml and tools/ci_release.py. The release environment (required reviewer, main only) was created first. dry_run defaults to true. Not a required check; nothing is published by merging this.
🤖 Generated with Claude Code