Repository navigation
fix: public CLI v0.3.2 audit, stale labels and immutable reusable source - #38
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Catalog postmerge public audit Run39348441311 failed (retained, not waived): verify-published-pages still demanded cli-v0.3.1 and its EXE SHA while EN/JA download pages had already moved to cli-v0.3.2. Also found stale homepage eyebrow and Release-link labels.
Reconcile the HTML contract with independently GET-checked public CLI Release417855312 / EXE657731413: SHA256 d4e8f63d402066b21db9d537f7679b51137ec47d9834fa4fd75b5889ad34e6f4, size12829662. Extract an offline-testable served-HTML contract retaining exact tag/hash, locale separation, fixed mode, verbose controls/log file and safety labels; correct the four stale visible labels without altering historical v0.3.1 size comparisons.
Make reusable audit checkout job.workflow_repository/job.workflow_sha with persist-credentials:false instead of mutable main, so the cross-repository full-SHA pin actually selects its verifier code. Keep all public original-byte/Catalog/fleet/headless Chrome checks and read-only permissions.
Validation: 64 local Node tests PASS, including real EN/JA HTML fixtures and negative stale tag/hash/label, missing verbose and wrong-locale cases. Require native exact-head checks, protected merge, Pages deployment/public audit and then Catalog protected pin refresh. No extension Release, authorization, signer, permission or Catalog data change. Ref pgextwin/build#75, pgextwin/build#141.