Repository navigation
ci: select verified trust for dependency and browser downloads - #202
Merged
Merged
Conversation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Continues durable-workflow/.github#237. Move ten Python CI/documentation/build
bootstrap calls from the earlier pip-bundle check to the reviewed immutable
clean-trust action
75587fc3. Declare the pip/Python clients for SDK, packageand documentation jobs so later requests inherit the verified CA file and empty
additional-root directory, including isolated package-build subprocesses. The
central preflight keeps its reviewed no-input step and uses the pip default.
Chromium installation invokes Playwright's Node downloader. Select OpenSSL's
verified file/directory for those two steps and disable additive/system Node
roots there. The ordinary shared action intentionally makes no raw-Node store
claim, so the caller selects this explicitly.
The protected PyPI upload job, its artifact binding, Environment and credentials
are untouched. It is a separate job and does not inherit the build job's exported
paths. Package code, dependencies, version, install graph and release inputs
stay unchanged. Independent publisher/container and runner bootstrap boundaries
remain tracked on the parent issue.
Verification
All six workflows pass the current central policy validator from main
f14766da, using a hash-verified offline PyYAML parser. The central preflightretains the closed reviewed step form. No policy relaxation is introduced.
Normal central workflow-policy, SDK/package/integration and developer-portal
checks must qualify this exact source. No package publication or account
configuration is performed by this change.
Delivered
Candidate
b75f6a33passes all 18 checks, including Sonar with zeroOPEN/CONFIRMED findings. Normal merge
2da02a7ac8a68a7cd4267e86ef10e0198a309592preserves exact tree
f743fdf8ecc2dd1f9f02a029182eb733eab6b00e. The remote headis deleted and verified absent. Independent main CI 39895327290 and portal
39895327295 pass. The actual public portal audit binds the exact merge revision.
This is CI/deployment qualification; PyPI 2.9.1 remains unpublished.