9 Commits

Include renames

Author	SHA1	Message	Date
james.maesandClaude Sonnet 5.5	04d80f272d	feat(ci): read-only private Maven package prefetch with reviewed-commit bootstrap, and standalone images ... Adds the plumbing a repository needs to resolve private QRun-IO Maven packages during verification without exposing the credential to the tests or to any image step: - .ci.yaml component field package_reads: {binding}; plan target field and a matrix flag `packages`. - `prefetch-packages` command (platform_ci/package_prefetch.py): authorizes the binding and the consuming repository against runtime/package-reader-bindings.yaml, and runs only for a push to the default branch or a SAME-REPOSITORY pull request whose forge-supplied head commit is an exact entry of the binding's reviewed_commits (empty by default, so inert; no forks, no other commits, no branch patterns). Authorization runs before the credential check, any project-file read or any child process. It fills the local Maven repository with `dependency:go-offline` using credential settings that hold only ${env.CI_PACKAGE_READ_TOKEN}; the token is in that one Maven child's environment and the settings live in a scratch directory deleted even on failure. The registry id is pinned to the constant URL by a mirror, the repository-declared tool environment is not merged, maven.ext.class.path is cleared, and .mvn launch files and POMs with build extensions, a reference to the credential variable or a repository claiming the registry id with another URL are refused before the token exists. Neither path writes the dependency cache. - the step is placed before "Build and test" in the three container verify jobs; verification and image steps never receive the token and run with the credential-free public settings. image-prebuild and the image boundary are unchanged. - runtime/package-reader-bindings.yaml: binding kof22-qrun-read for KofTwentyTwo/Website-Backend (slot PACKAGE_READ_TOKEN, registry user qqq-package-reader), reviewed_commits empty. - images: `standalone: true` for an image that contains no verified build output (still scanned and source-bound; recompile and entitlement refusals unchanged). Tests cover configuration, prefetch authorization, credential handling, the guard (including the real host POM shape) and standalone rules. Single commit equivalent of reviewed PR 72 (head 14e66a5e) merged onto current main; the three overlapping files differ from PR 72 only by main's own concurrent changes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 15:35:44 +00:00
forge-recoveryandClaude Sonnet 5.5	a36f17b857	feat(ci): advance shared pipeline capabilities ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 10:30:25 +00:00
forge-recoveryandClaude Sonnet 5.5	76dd2b0394	feat(ci): advance shared pipeline capabilities ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 05:29:30 +00:00
forge-recoveryandClaude Sonnet 5.5	84c6f19438	feat(ci): advance shared pipeline capabilities ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 05:03:47 +00:00
forge-recoveryandClaude Sonnet 5.5	70eb3ee0ab	feat(ci): advance shared pipeline capabilities ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 04:36:22 +00:00
forge-recoveryandClaude Sonnet 5.5	fd4689fd19	feat(ci): reuse verified builds before merge verification ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 03:54:30 +00:00
forge-recovery	4bee62d0b1	fix(ci): include Node runtime for security artifact upload	2026-11-05 02:54:06 +00:00
forge-recoveryandClaude Sonnet 5.5	f2fbacf131	feat(ci): qualify shared security checks and available native cache ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 02:48:54 +00:00
forge-recoveryandClaude Sonnet 5.5	2af1dcf3a2	feat(ci): add configuration-driven verification and dependency caching ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 00:29:44 +00:00