Skip to content

fix(release): bind published assets to checksum manifest - #22

Merged
DTALEX66 merged 4 commits into
mainfrom
release/v0.4.0-contract
Jul 30, 2026
Merged

fix(release): bind published assets to checksum manifest#22
DTALEX66 merged 4 commits into
mainfrom
release/v0.4.0-contract

Conversation

@DTALEX66

Copy link
Copy Markdown
Owner

Summary

  • stage the Windows installer under a provider-stable filename before hashing
  • require the staged payload set to exactly match SHA256SUMS
  • publish an explicit four-asset allowlist instead of a wildcard

Evidence

  • RED: 2 focused contract tests failed against the v0.4.0 workflow
  • GREEN: full release-manifest suite passed (16 tests)
  • workflow YAML and all embedded PowerShell blocks parsed successfully

Release policy

The existing v0.4.0 tag and release remain immutable. After merge, closure requires exact-SHA CI and publication/readback under a new tag/release.

@DTALEX66
DTALEX66 merged commit 34936f1 into main Jul 30, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant