Repository navigation
The release feed vouches for the code: each package's commit, and every workflow's actions pinned - #94
Merged
Conversation
…ry workflow's actions pinned Quire's signed feed vouched for version numbers only: a tag moved in a package's repository, or other code served for it, reached every new site and update unseen (Quire Server's audit, SUPPLY-04). Each release in feed.json now says each package's commit in the repository Composer installs it from. The release computes them itself with .github/split.sh <tag>, without pushing: the split gives the same commits for the same history (checked against v0.1.2's published tags). Releases before this one are given their tags' commits as they are when a release is made. The skeleton's commit is left out: it's built on its repository's main at the time, and its files, already in the feed, vouch for it. Every workflow's actions are pinned by commit (Split's too, the one that holds the key to the package repositories); Dependabot proposes their updates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Quire's signed feed vouched for version numbers only: a tag moved in a package's repository, or other code served for it, reached every new site and update unseen (Quire Server's audit, SUPPLY-04). Each release in feed.json now says each package's commit in the repository Composer installs it from. The release computes them itself with .github/split.sh , without pushing: the split gives the same commits for the same history (checked against v0.1.2's published tags). Releases before this one are given their tags' commits as they are when a release is made. The skeleton's commit is left out: it's built on its repository's main at the time, and its files, already in the feed, vouch for it.
Every workflow's actions are pinned by commit (Split's too, the one that holds the key to the package repositories); Dependabot proposes their updates.
What and why
How it was tested
Checklist
composer qapassesdocs/or the README