Repository navigation
Run protected publication with artifact credentials and explicit canary mode - #236
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The deployed publisher used a shell step, which did not receive GitHub’s artifact runtime credentials. Consequently, both terminal no-effect receipts and intent receipts could not be acknowledged. Add a fixed, bounded JavaScript action launcher that passes the runner’s trusted runtime environment to the protected Python publisher and exposes only its sanitized outcome.
A separate canary issue appeared when a valid analysis returned APPROVE: the existing COMMENT-only policy correctly rejected the approval event. Add an explicit closed v5 NON_BINDING_COMMENT publication mode. It preserves the original result, verdict, and validity checks while authorizing only a clearly labeled GitHub COMMENT. The exact mode, result, body, event, policy, receipt, and replay identities remain bound. Earlier policy versions retain their strict behavior.
This change does not alter model prompts, classifier thresholds, coverage requirements, provider budgets, or target merge behavior. Actual rejected/unknown canary outcomes are retained as evidence. Validation: 180 focused tests passed before the final corrections; all 62 affected tests passed afterward. Independent review cleared the candidate, with 169 focused tests, five packaging tests, and the corrected 62-test subset passing. The atomic pin update passed 58 focused tests and separate review. Syntax, Ruff, JSON, and diff checks passed. Hosted publication and replay remain rollout verification steps.