base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Clarify page-only delivery and artifact verification

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-01 21:15:28 +00:00
parent 9fa440726e
commit d368bb32f9
3 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/consumers/delivery.md
View File

@@ -46,7 +46,9 @@ toolchain. Inside a Git checkout, `RepositoryDir` can name a subdirectory;
empty selection chooses that root. Previously, a supplied checkout subdirectory
acted as the selection base. Outside a checkout, the supplied directory remains
the base for `ModuleDir`.
The operation may use the network and updates the Go module cache while
Preparation overrides an alternate module file selected by `GOFLAGS`, while
retaining other effective Go settings. The operation may use the network and
updates the Go module cache while
preserving the caller's proxy, private-module, credential, and cache settings.
If checksums are missing, Go may update `go.sum`. For binary CI delivery, prepare
and commit the selected module's `go.sum` before tagging: delivery verifies the
@@ -216,12 +218,17 @@ To deliver binaries built separately, set `Prebuilt` to the `BuildResult`.
ReleaseKit checks its repository, module directory, declared module path, full
tag, semantic version, tagged commit, normalized settings, and artifact evidence
against the selected committed module. Binary results must record verified
source. The current files are checked against their recorded digests before any
hosted request. The files remain caller-owned, so callers can retain the
original bytes for retries and are responsible for cleanup. With neither
source. After cheap local and source checks, delivery performs read-only
credential preflight, verifies the local artifacts in full, and then makes
hosted writes. The current files are checked against their recorded digests
before those writes. Preflight confirms only the access evidence available from
the service, as described above. The files remain caller-owned, so callers can
retain the original bytes for retries and are responsible for cleanup. With neither
artifact source, an empty managed target set, or a matching empty prebuilt
result, delivery is page-only. Do not set both `Build` and `Prebuilt` in one
request.
result, delivery is page-only. A prebuilt result with no targets or artifacts
must still identify the matching repository, module directory and path, tag,
commit, and version; a zero `BuildResult` does not. Do not set both `Build` and
`Prebuilt` in one request.
```go
result, err := releasekit.Deliver(ctx, releasekit.DeliveryRequest{