This repository has been archived on 2026-11-08. You can view files and clone it. You cannot open issues or pull requests or push a commit.

james.maesandClaude Sonnet 5.5 04d80f272d feat(ci): read-only private Maven package prefetch with reviewed-commit bootstrap, and standalone images ...

Adds the plumbing a repository needs to resolve private QRun-IO Maven packages during verification without exposing the credential to the tests or to
any image step:
- .ci.yaml component field package_reads: {binding}; plan target field and a matrix flag `packages`.
- `prefetch-packages` command (platform_ci/package_prefetch.py): authorizes the binding and the consuming repository against
  runtime/package-reader-bindings.yaml, and runs only for a push to the default branch or a SAME-REPOSITORY pull request whose forge-supplied head commit is an
  exact entry of the binding's reviewed_commits (empty by default, so inert; no forks, no other commits, no branch patterns). Authorization runs before the
  credential check, any project-file read or any child process. It fills the local Maven repository with `dependency:go-offline` using credential settings
  that hold only ${env.CI_PACKAGE_READ_TOKEN}; the token is in that one Maven child's environment and the settings live in a scratch directory deleted even on
  failure. The registry id is pinned to the constant URL by a mirror, the repository-declared tool environment is not merged, maven.ext.class.path is
  cleared, and .mvn launch files and POMs with build extensions, a reference to the credential variable or a repository claiming the registry id with
  another URL are refused before the token exists. Neither path writes the dependency cache.
- the step is placed before "Build and test" in the three container verify jobs; verification and image steps never receive the token and run with the
  credential-free public settings. image-prebuild and the image boundary are unchanged.
- runtime/package-reader-bindings.yaml: binding kof22-qrun-read for KofTwentyTwo/Website-Backend (slot PACKAGE_READ_TOKEN, registry user qqq-package-reader),
  reviewed_commits empty.
- images: `standalone: true` for an image that contains no verified build output (still scanned and source-bound; recompile and entitlement refusals
  unchanged).
Tests cover configuration, prefetch authorization, credential handling, the guard (including the real host POM shape) and standalone rules.
Single commit equivalent of reviewed PR 72 (head 14e66a5e) merged onto current main; the three overlapping files differ from PR 72 only by main's own
concurrent changes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-11-05 15:35:44 +00:00

..

catalog.yaml

feat(ci): advance shared pipeline capabilities

2026-11-05 10:30:25 +00:00

checkout-bindings.yaml

feat(ci): advance shared pipeline capabilities

2026-11-05 10:30:25 +00:00

control.Dockerfile

feat(ci): add configuration-driven verification and dependency caching

2026-11-05 00:29:44 +00:00

package-reader-bindings.yaml

feat(ci): read-only private Maven package prefetch with reviewed-commit bootstrap, and standalone images

2026-11-05 15:35:44 +00:00

SECURITY-RUNTIME.md

feat(ci): qualify shared security checks and available native cache

2026-11-05 02:48:54 +00:00

security.Dockerfile

fix(ci): include Node runtime for security artifact upload

2026-11-05 02:54:06 +00:00

TOOL-SECURITY.md

feat(ci): add configuration-driven verification and dependency caching

2026-11-05 00:29:44 +00:00

toolchain.Dockerfile

feat(ci): add configuration-driven verification and dependency caching

2026-11-05 00:29:44 +00:00