ci(release): verify release provenance for backfill publishes - #447

Open

beardthelion wants to merge 23 commits into

Twigpine:mainfrom

beardthelion:fix/234-release-publish-environment-gate

Commits on Sep 13, 2026

ci(release): gate publish jobs on the release environment, anchor the tag check, pin npm
beardthelion
committed
6514037
ci(release): qualify tag checkouts and keep moving tags forward-only
beardthelion
committed
7ef1b9c
ci(release): gate every job on the release environment and verify tag provenance
beardthelion
committed
7b8e182
ci(release): qualify the provenance compare and fail closed on npm lookup errors
beardthelion
committed
a219ed1
ci(release): check release author, decide npm dist-tag per package, close the test gap
beardthelion
committed
0742c67
ci(release): anchor docker moving tags to the registry floor, not the release pointer
beardthelion
committed
7d9b6e1
ci(release): require backfill release assets to be automation-uploaded
beardthelion
committed
e005dda
ci(release): pin the verified commit and the exact asset bytes end to end
beardthelion
committed
ab0a32e
ci(release): run the resolver on the producer path and hash homebrew inputs locally
beardthelion
committed
1a9f51f
ci(release): bind the tag to the commit its release was created against
beardthelion
committed
73d560e
ci(release): force bash for the release-binaries resolver step
beardthelion
committed
64c4ea5
ci(release): base64 release-asset names in the resolver map
beardthelion
committed
55a6a2a
Address PR review feedback (#447)
beardthelion
committed
7c88dc2
Address PR review feedback (#447)
beardthelion
committed
7c33483
ci(release): freeze docker moving tags on dispatch, retire the registry floor
beardthelion
committed
c55fec5
ci(release): make the resolver test's gh stub discriminate on the full call
beardthelion
committed
57968b0
ci(release): assert the pinned npm version took effect
beardthelion
committed
d02bb32
ci(release): surface missing-asset errors from the formula sha() subshell
beardthelion
committed
c5d2dbc
ci(release): consume resolver outputs instead of release-please outputs post-resolve
beardthelion
committed
13a1fff
ci(release): document the concurrency group's pending-slot replacement
beardthelion
committed
e455db1
ci(release): share the image output and bound the step scanners to jobs
beardthelion
committed
ef4d29a
ci(release): close the review-found evasions in the release checks
beardthelion
committed
d2d6660
ci(release): floor the moving tags against the releases list
beardthelion
committed
2f04ac1

Navigation Menu

ci(release): verify release provenance for backfill publishes - #447

ci(release): verify release provenance for backfill publishes#447
beardthelion wants to merge 23 commits into
Twigpine:mainfrom
beardthelion:fix/234-release-publish-environment-gate

Commits on Sep 13, 2026

ci(release): gate publish jobs on the release environment, anchor the tag check, pin npm

ci(release): qualify tag checkouts and keep moving tags forward-only

ci(release): gate every job on the release environment and verify tag provenance

ci(release): qualify the provenance compare and fail closed on npm lookup errors

ci(release): check release author, decide npm dist-tag per package, close the test gap

ci(release): anchor docker moving tags to the registry floor, not the release pointer

ci(release): require backfill release assets to be automation-uploaded

ci(release): pin the verified commit and the exact asset bytes end to end

ci(release): run the resolver on the producer path and hash homebrew inputs locally

ci(release): bind the tag to the commit its release was created against

ci(release): force bash for the release-binaries resolver step

ci(release): base64 release-asset names in the resolver map

Address PR review feedback (#447)

Address PR review feedback (#447)

ci(release): freeze docker moving tags on dispatch, retire the registry floor

ci(release): make the resolver test's gh stub discriminate on the full call

ci(release): assert the pinned npm version took effect

ci(release): surface missing-asset errors from the formula sha() subshell

ci(release): consume resolver outputs instead of release-please outputs post-resolve

ci(release): document the concurrency group's pending-slot replacement

ci(release): share the image output and bound the step scanners to jobs

ci(release): close the review-found evasions in the release checks

ci(release): floor the moving tags against the releases list