Skip to content

docs: library-only docs and config (XWING-2350) - #124

Merged
smith-xyz merged 1 commit into
developmentfrom
docs/library-only
Oct 23, 2026
Merged

smith-xyz merged 1 commit into
developmentfrom
docs/library-only

Conversation

@smith-xyz

Copy link
Copy Markdown
Contributor

Keeps only what a library needs, now that traust-ledger is traust_ledger.integrity and nothing else.

File Change Why / where it went
.env.example deleted the old service's LAAS_* / LEDGER_* settings (storage backend, OIDC, signing, uvicorn). Their replacements are traust-core's ledger: and identity: config sections; the mapping is in traust-core's docs/configuration.md
.tekton/ (2 pipelines) deleted Konflux builds of a container from the Containerfile removed in #121: every run has nothing to build. The Konflux component lives in the tenant and still needs offboarding (followup)
renovate.json Go, npm and Konflux-image rules removed the library has Python dev dependencies and GitHub Actions only
SECURITY.md rewritten scope is the integrity library (storage, auth and who may write are traust-core's); fixes land on development and consumers move their pin; there are no releases
CONTRIBUTING.md "bypass with --no-verify" removed don't bypass the hooks; CI enforces the same checks
CODEOWNERS comment matched to the rulesets (development, required checks)
.gitignore .env.local dropped —
README.md, AGENTS.md the frontier (appends without rereading) traust-ledger#123
docs/ledger-integrity.md signing from metadata alone (how a frontier writer seals); historical layers, SCI's ledger database included, stay signed artifacts and are never loaded into traust-core's tables traust-core#56; api-spec §16 corrected

No code change: make lint, make test (293 passed).

…d the container build

Deletes .env.example (the old service's LAAS_* settings; traust-core's ledger and identity config replaced them) and .tekton/ (Konflux builds of a Containerfile removed in #121, so every run failed). Trims renovate.json to Python and GitHub Actions. SECURITY.md covers the integrity library on development, pinned by commit. CONTRIBUTING no longer suggests bypassing hooks; CODEOWNERS comment matches the rulesets. README, AGENTS and ledger-integrity.md cover appends from a frontier and signing from metadata, and say historical layers (SCI's included) stay artifacts.
@smith-xyz
smith-xyz requested a review from a team as a code owner October 23, 2026 03:24
@openshift-ci

openshift-ci Bot commented Oct 23, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 23, 2026
@smith-xyz
smith-xyz merged commit d6fa1a2 into development Oct 23, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant