Repository navigation
Default IPFS artifacts to Liskov OIDC upload intents - #20
Merged
firegrass merged 1 commit intoOct 12, 2026
Merged
Conversation
BKLG-20261006-tae2 implements ADR-0180 and ADR-0222: request a GitHub OIDC upload intent for an explicit organization/application, upload exact bytes with its masked token, and verify the returned gateway. Preserve explicit proxy uploads and CID reuse; expose upload ID/path and wire workflow configuration.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
ipfs-endpointis empty,ipfs-pinnow requests a GitHub OIDC upload intent for the caller's explicit organization/application, uploads the exact artifact with the masked per-run token, and verifies bytes through the returned PROOF gateway. An explicit endpoint retains the proxy multipart contract; existing CID reuse stays unchanged. Refusals preserve the server code, includingsource_binding_revoked, and never fall back to the proxy.Adds action upload ID/path outputs and wires
organization-id,liskov-url, and the repository-relative authored manifest into the reusable workflow. Manifest digests reuse the policy contract used by attestation, with artifact-byte sha256 when no manifest is supplied. README and committed action distribution are updated.BKLG-20261006-tae2; ADR-0180 and ADR-0222.
Validation passed on commit
28d45ff058b70305ed22ef30adbc652f7cbd09ae, tree85e26569a116bbc174ccc02987dd0448ace02f5c: frozen pnpm install, typecheck, all 84 TypeScript tests and 10 Python tests, Python compileall, andpnpm check:distthrough the complete rig gate. Final-diff doctrine and ci-preflight checks completed. Fixtures cover exact intent/upload/gateway requests, canonical manifest digest, encrypted artifact bytes, proxy/reuse compatibility, refusals, masking, and workflow wiring.Release handoff: a person tags the next
v2.x.0and movesv2; this PR cuts no release. Diagnostic caller and public docs updates remain with BKLG-20261006-vyk8/71n0, and the person-only BKLG-20260625-jws4 join owns the live canary and availability claim.