Conversation
PhotoCleaner finished onboarding: declares its real docker (static-secret) + github-release targets, both Docker Hub secrets, two-phase release trigger, and refreshed drift notes. Clears the four false-positive stale-secret DRIFTs; registry-only, no fleet re-vendor.
…#415) normalize() masks a uses:<action>@<40-hex sha> pin and its version comment, so a release repo's verbatim github-release region stops drifting on routine Dependabot action bumps while a real structural fork still differs. Selftest + fidelity-model.md updated.
) Self-contain the Verification Discipline lint-gate bullet (drop the named sibling section), fix the Git and Commit Rules history-rewrite grammar (a signature from your key), and reword WORKFLOW.md D4.2 (built commit, never a branch name or a separately re-resolved ref, not never github.sha). Re-vendors two verbatim AGENTS sections + WORKFLOW.md.
#417) Full publish atomicity: build-docker needs every other build and guards with !failure() && !cancelled(), so a failed build blocks the image push (matching github-release) while a skipped/disabled target still builds on smoke. Documented as WORKFLOW.md D4.5. The release-task interface contract now requires validate-release, flagging the older repos to adopt the entry-gate job.
Contributor
There was a problem hiding this comment.
Pull request overview
Promotes develop to main, carrying the latest fleet-governance and release-pipeline reconciliation updates: release-task contract tightening (validate-release required), publish atomicity clarification, and audit normalization changes to stop verbatim github-release drift on routine action-SHA bumps.
Changes:
- Extend the release-pipeline contract to require a
validate-releaseentry gate and document the “all builds must pass before any publish target” rule. - Update the verbatim fidelity model and audit normalization to neutralize
uses: <action>@<40-hex sha>pins (and their# vNcomments) in content hashing. - Reconcile the PhotoCleaner registry entry to its real publish shape (docker + GitHub release, secrets, two-phase trigger) and vendor related prose fixes in AGENTS/WORKFLOW.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| WORKFLOW.md | Clarifies tag targeting semantics and documents D4.5 “no partial publish” behavior. |
| spec/files.json | Tightens the build-release-task interface contract to require validate-release. |
| spec/fidelity-model.md | Updates fidelity semantics to include action-pin normalization for verbatim hashing. |
| spec/audit.py | Implements action-pin normalization in normalize() and adds selftest coverage for it. |
| registry/repos.json | Updates PhotoCleaner’s declared publish mechanisms, required secrets, trigger, and drift notes. |
| catalog/snippets/workflows/build-release-task.yml | Gates Docker build/push on overall build success while still allowing smoke builds. |
| AGENTS.md | Vendors canonical prose fixes (grammar and self-contained lint-gate guidance). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promote develop to main. Four PRs from the PhotoCleaner/PlexCleaner/finmod convergence and the #414 release-pipeline reconciliation:
github-releaseregion stops drifting on routine action-SHA bumps.validate-releasein the release-task interface contract.Fleet impact: re-vendors the verbatim Verification Discipline and Git and Commit Rules AGENTS sections; the release-task contract now flags the older repos (PhotoCleaner/PlexCleaner) to adopt the
validate-releaseentry-gate job. Burn-down tracks it.Merge commit, not squash. No release fires (a human merge never auto-publishes).