base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Validate CI module tags before delivery preparation

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-01 19:27:56 +00:00
parent 9376bafaa2
commit 078db6cbcb
4 changed files with 83 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/roadmap/remediation.md
View File

@@ -197,7 +197,15 @@ cleanup; this finding does not require removing plans now.
## 5. Bind CI release identity before online preflight and preparation — P2
Status: open.
Status: complete.
**Completed:** CI now derives the selected module identity from the verified
event commit and checks the complete tag before credential loading, forge
requests, or dependency preparation. The optional launcher-module guard and
delivery's later source/preflight verification retain their responsibilities.
A focused page-only/binary regression covers a matching launcher selection
with a mismatched derived tag and verifies no forge or Go-tool work. That test
and existing valid CI/preflight/managed-delivery tests passed.
**Evidence:** [CI adapter](../../cmd/releasekit/main.go), especially
`runCIDelivery` and `checkExpectedModule`, and the existing identity/tag checks