base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Verify the audit remediation changes

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 03:41:01 +00:00
parent 9dc87ae996
commit 2f95753d9c
6 changed files with 46 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/internal/validation.md
View File

@@ -19,11 +19,12 @@ artifact or executing a target binary. Test, vet, and package-compilation
failures retain their `go-test`, `go-vet`, and `package-compile` identities,
selected target where applicable, and underlying causes. Its
request carries the captured repository directory and commit, output writer,
and internal settings. When selected, the Go-format check loads the candidate
tree once, reads regular Go blobs from the captured commit, and compares them
with go/format output. It uses the selected inputs, including vendor and explicit
shared files, and skips
symlink blobs, reports all unformatted paths, and stops with a contextual cause
and internal settings. The Go commands run before the committed-tree sequence,
which owns its reader's lifetime and close-error attribution. When selected,
the Go-format check loads the candidate tree once, reads regular Go blobs from
the captured commit, and compares them with go/format output. It uses the
selected inputs, including vendor and explicit shared files, skips symlink
blobs, reports all unformatted paths, and stops with a contextual cause
on parse or inspection errors. It runs before product checks and build callbacks.
`Request.ReadCandidateTree` lets selected file checks request candidate
contents; the Go-only path does not enumerate the tree.
@@ -109,9 +110,11 @@ observations remain out of scope under either setting. Observations go to the
provided writer; a nil writer keeps library use quiet. Public selection is
defined in the [configuration reference](../config.md) and GoDoc.
Committed-tree metadata and blob reads disable lazy fetching and Git transports
for those child commands. Missing local objects produce inspection errors;
source preparation retains its separate network-capable operations. See Git's
ReleaseKit-owned Git commands inspect original objects even when replacement
refs exist. Committed-tree metadata and blob reads also disable lazy fetching
and Git transports for those child commands. Missing local objects produce
inspection errors; source preparation retains its separate network-capable
operations. See Git's
[lazy-fetch controls](https://git-scm.com/docs/git) for the command mechanism.
Candidate and delivery release-note reads use the same local object boundary.