fix(releases): stabilize acceptance and pin verified signing builder #37
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/MarkdownViewr.Windows#37
Reference in new issue
Block a user
The protected releases encountered two blockers: the full111-test Windows acceptance suite ran into its600-second process budget, and Microsoft's signing action dependency installer conflicted with the caller's NuGet source mapping. A subsequent completed run exposed an immediate keyboard assertion reading jk before the required jkg value.
Allow900 seconds for each full published/installed suite and60 minutes for all three suites plus packaging/update probes. Individual test deadlines, assertions and filters remain unchanged. Keep the exact jkg assertion, first awaiting that exact native textbox value within the existing10-second deadline; FlaUI5.0.0's UntilInputIsProcessed only sleeps100ms. Add this exact case to the focused hosted regression job. No input is replayed and a genuinely lost key still fails.
Pin published immutable standards1.1.1 at96cbdf208a15c9c524676bd15ff9e323228a952b. The owner personally reviewed its signing fix in PR44; it merged normally and production builder release38322016784 succeeds. The fixed official dependency staging verifies the exact package SHA256 and NuGet signatures without changing application package source mapping, OIDC trust or signing verification. Preserve only the previously approved exact Syft entry in the setup plan, retaining restrictive container regression tests.
Refs #33. EXE/ZIP first, MSI next release (#36), following the latest owner decision. No app release exists; preserved failed1.0.0 tags will not be rewritten. New app candidates will use1.0.1/stable and1.0.1-beta.1/dev after this reviewed exact-head CI passes.
Validation: zero-warning app/test builds and test formatting;42 process/registry/setup boundary tests pass, zero skips; configured PowerShell analysis, actionlint, medium-and-above workflow security gate and all commit hooks pass. The scan's five preexisting low self-repository recommendations remain unchanged. Fresh full native/published/installed hosted acceptance is running. Local baseline and changed keyboard runs both stop earlier at missing FindText, so neither verifies the hosted jkg fix. Temporary fixture diagnostics removed; original user previews/profiles preserved.
Substantial AI assistance: Codex GPT-6. Genuine final-head maintainer review under K22-AI-01 is required before merge. This PR contains no application behavior change or weakened assertion.
Automated review of exact head
a3cab85916(Codex): no code findings identified in this release-fix diff.The keyboard change waits for the exact existing jkg assertion within the existing10-second deadline, without resending keys, changing focus or accepting partial text. A permanently lost key still fails. Full-suite runtime remains bounded; real process tests prove hangs/nonzero exits fail. The caller pins published verified standards1.1.1, and the setup plan adds only the owner-approved exact Syft digest. Application/runtime code and trust scopes are unchanged.
Actual focused hosted report:30/30 pass,0 failures/skips; ReadingKeys_FindAndTextFocus_PreserveLiteralInput passes in6.5802129sec. Local42 process/registry/setup boundaries, zero-warning builds, formatting, configured script analysis and workflow checks pass. Full native and published/installed acceptance are still running and must pass before merge.
Genuine maintainer review is still requested; this comment does not assert it occurred or satisfy the acknowledgement gate by itself.
Tool: Codex
Findings: none
Summary: Exact release-fix diff reviewed: retained literal jkg assertion and existing10-second deadline, bounded suite budgets, released personally reviewed signing builder pin, and exact previously approved Syft setup entry. No application behavior or trust-scope changes. Actual focused hosted report30/30 passes including literal-keyboard case, zero failures/skips;42 local process/registry/setup boundaries and required local build/format/analyzer/workflow gates pass. Full native/published/installed hosted acceptance must pass before merge.
Maintainer acknowledgement: I read the review and resolved or answered every finding.
Recorded from the owner's explicit session confirmation: "I reviewed PR #37 at
a3cab85and resolved all findings", answering the request to personally read and understand the final changes and resolve all findings. This is actual owner confirmation, not an independent human-review claim. The single-maintainer policy remains in force.