james.maesandCodex GPT-6
a44449b991
Stable1.0.2 and dev1.0.2-beta.1 EXEs/ZIPs are public and their actual downloaded signatures, timestamps, payloads, hashes, SBOM/provenance and updater feeds verify. Complete the owner's renewed MSI request by pinning standards1.2.0 at0ef3d319, enabling signed per-user MSI alongside EXE/ZIP, preparing1.0.3 channel links and next development prefix1.0.4. Stop duplicate release validation: a tag must be on main, have a verified source signature, match the entire genuinely merged PR Git tree, and reuse that head's latest successful required technical checks under their configured provider identities. Missing, failed, stale, pending or different-tree proof fails publication. All branch technical gates remain required; fresh release build/core coverage, signing, exact MSI payload/native lifecycle and distribution/SBOM/provenance checks remain required. Application behavior/dependencies/Azure trust are unchanged. Validation: all8 script tests pass (including10 release-proof boundary cases), live source proof verifies all17 genuine checks on the actual published18d8ae9 tree, five actual documents pass canonical lint, actionlint/zizmor and signed commit hooks pass. Exact-head full CI starts with this PR; production signed MSI lifecycle is still required before delivery. No claim of published MSI yet. Owner explicitly authorized release without further human-review requests. Record a truthful release-specific waiver; never fabricate personal-read acknowledgement; restore original rules immediately after the bounded merge. Substantial AI assistance: Codex GPT-6. Refs #33,#36,#38 and KofTwentyTwo/standards#47. --------- Signed-off-by: James Maes <james@kof22.com> Co-authored-by: Codex GPT-6 <noreply@openai.com>
44 lines
2.0 KiB
JavaScript
44 lines
2.0 KiB
JavaScript
// Copyright (c) 2026 James Maes (KofTwentyTwo)
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
"use strict";
|
|
|
|
const assert = require("node:assert/strict");
|
|
const test = require("node:test");
|
|
const { run } = require("./assert-release-source.cjs");
|
|
|
|
/** Exercises release-tree, check-provider and latest-result boundaries. */
|
|
test("reuses only verified identical-source passing CI", async () =>
|
|
{
|
|
for(const failure of [null, "signature", "tree", "merge", "provider", "pending", "failed", "missing", "latest", "rules"])
|
|
{
|
|
const check = { id: 1, name: "ci / ui-tests", app: { id: failure === "provider" ? 7 : 15368 },
|
|
status: failure === "pending" ? "in_progress" : "completed",
|
|
conclusion: failure === "failed" ? "failure" : "success" };
|
|
const github = {
|
|
rest: {
|
|
repos: { getCommit: async ({ ref }) => ({ data: { commit: {
|
|
verification: { verified: failure !== "signature" },
|
|
tree: { sha: failure === "tree" && ref === "head" ? "other" : "tree" },
|
|
} } }), listPullRequestsAssociatedWithCommit: "pulls" },
|
|
checks: { listForRef: "checks" },
|
|
},
|
|
request: async () => ({ data: failure === "rules" ? [] : [{ type: "required_status_checks",
|
|
parameters: { required_status_checks: [{ context: "ci / ui-tests", integration_id: 15368 }, { context: "review / automated" }] } }] }),
|
|
paginate: async method => method === "pulls" ? (failure === "merge" ? [] : [{ number: 1, state: "closed",
|
|
merged_at: "today", base: { ref: "main" }, merge_commit_sha: "release", head: { sha: "head" } }])
|
|
: failure === "missing" ? [] : failure === "latest" ? [check, { ...check, id: 2, conclusion: "failure" }] : [check],
|
|
};
|
|
const operation = run({ github, context: { repo: { owner: "owner", repo: "repo" }, sha: "release" }, core: { info: () =>
|
|
{} } });
|
|
if(failure)
|
|
{
|
|
await assert.rejects(operation);
|
|
}
|
|
else
|
|
{
|
|
assert.deepEqual(await operation, { head: "head", tree: "tree", checks: 1 });
|
|
}
|
|
}
|
|
});
|