QRun-IO/qqq-orb
Archived
2
0 Fork 0
Code Issues 6 Actions Packages Projects Releases 17 Wiki Activity

Publish versions without bypassing protected branch requirements #19

New Issue
Open
opened 2026-10-01 03:22:00 +00:00 by KofTwentyTwo · 0 comments
KofTwentyTwo commented 2026-10-01 03:22:00 +00:00 (Migrated from github.com)
Copy link
Copy source

Frontend-core snapshot job388 published a verified package but its automated version commit3793e215f6994f375b4ebe7d16df735e5052d02a is unsigned. The version-push log reports bypasses of verified signatures, PR-only changes and required test_only. Reviewed source PR48 and its merge08eed585 are signed and checked; the published package differs only by its intended version. Preserve the immutable package and this source binding.

The current node_version_commit.sh commits package.json directly, pushes HEAD to the protected branch and treats push failure as nonfatal. Replace that path with a version/publication procedure that respects normal signed-commit, PR and check protections without weakening rules or relying on bypass credentials. Preserve correct next-version calculation and public gitHead/artifact provenance; explicitly reconcile publish/push partial failures and concurrent builds before retry. Assess the corresponding Maven version-commit path before final release publication.

Acceptance: tests cover snapshot/RC/stable version selection, collision/race and failed-push/publish handling; a representative pipeline produces a new immutable package whose provenance is tied to reviewed source, with no protection bypass or credential output. No artifact overwrite, protection changes, broad credential grants or Next implementation.

Evidence: https://circleci.com/gh/QRun-IO/qqq-frontend-core/388 and https://github.com/QRun-IO/qqq-frontend-core/pull/48. Related QRun-IO/qqq#902 and QRun-IO/qqq#921; public-package compatibility and this pipeline-policy finding are separate claims.

Frontend-core snapshot job388 published a verified package but its automated version commit3793e215f6994f375b4ebe7d16df735e5052d02a is unsigned. The version-push log reports bypasses of verified signatures, PR-only changes and required test_only. Reviewed source PR48 and its merge08eed585 are signed and checked; the published package differs only by its intended version. Preserve the immutable package and this source binding. The current node_version_commit.sh commits package.json directly, pushes HEAD to the protected branch and treats push failure as nonfatal. Replace that path with a version/publication procedure that respects normal signed-commit, PR and check protections without weakening rules or relying on bypass credentials. Preserve correct next-version calculation and public gitHead/artifact provenance; explicitly reconcile publish/push partial failures and concurrent builds before retry. Assess the corresponding Maven version-commit path before final release publication. Acceptance: tests cover snapshot/RC/stable version selection, collision/race and failed-push/publish handling; a representative pipeline produces a new immutable package whose provenance is tied to reviewed source, with no protection bypass or credential output. No artifact overwrite, protection changes, broad credential grants or Next implementation. Evidence: https://circleci.com/gh/QRun-IO/qqq-frontend-core/388 and https://github.com/QRun-IO/qqq-frontend-core/pull/48. Related QRun-IO/qqq#902 and QRun-IO/qqq#921; public-package compatibility and this pipeline-policy finding are separate claims.
This repo is archived. You cannot comment on issues.
No Branch/Tag Specified
Labels
Clear labels
bug
Something isn't working
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: QRun-IO/qqq-orb#19