Validate a release submitted by pull request - #33
Open
Maximilian-Nesslauer wants to merge 8 commits into
Open
Conversation
- `download` is public: the release pull request check downloads from the URL a submission names, not from a host it polled. - The bearer token goes out only when the parsed hostname is api.github.com. A string prefix let a look-alike name or a userinfo part collect it, and a submitted URL is the author's.
- A corrupt, encrypted or unsupported entry raised past the StampError handlers and read as a defect in tools/. It is a fact about the archive, so it is a StampError now. - The one entry the stamper unpacks is bounded by its declared size, 1 MiB, so an inflated mod.toml cannot exhaust the runner.
- RFC 0033 names two shapes that merge themselves: release files of one listing, all modified, and exactly one new file. - Two added files, or an added file next to an amendment, wait for a steward.
- The shape and the URL scheme are checked before anything is requested, and the listing has to exist in content-index without a [releases] section. - The archive is downloaded from download.url and stamped again with stamp_release, and every field that differs is reported. - The release date, the pre-release flag and the changelog are the author's word, because no archive carries them. - Three outcomes: pass, reject, and could-not-evaluate when the host does not answer.
- An added release file goes to the release check, everything else to the amendment check, and a path the base branch already has is rejected before any download. - A local --changed run reads a release file main lacks as added, and --authored names the content-index checkout. - The release check runs without the job's token, and more than one added file fetches nothing.
- The privileged half reads the listing through check_release, one implementation for both flows. - The messages cover a submitted release as well as an amendment. - The ownership contract test loads the real module under its own name, because the stub another test imports was what it asserted against.
- A submitted release is derived against the listing it belongs to, so the verdict job checks content-index out beside the repository.
Maximilian-Nesslauer
added
area:infra
Maximilian-Nesslauer
requested review from
Awsomgamr999,
MrJeranimo,
PlazmaBoltz and
averageksp
September 2, 2026 18:00
Contributor
|
Validated. A steward has to merge this one, because the change touches no release file. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #6.
A listing without a
[releases]section gets its releases by pull request: one new file underreleases/<id>/<version>.json, stamped withtools/stamp_release.py.The checks do not trust the file. They download the archive from its
download.url, stamp the release again with the same code the watcher uses, and reject the pull request when any field disagrees. The release date, the pre-release flag and the changelog are the author's word.Ownership and auto-merge work as in the listing flow, through
links.repository. The amendment check is unchanged, and a change that is neither one new file nor an amendment waits for a steward.A listing that names a release host is refused on this path, because the watcher stamps its releases from there.