Repository navigation
Generate V5 runtime-image callers with released v2 workflow - #80
Merged
firegrass merged 1 commit intoOct 13, 2026
Merged
Conversation
BKLG-20261013-6kzp; ADR-0068. Validate the registered source document through the existing policy client, require native_image and an authored digest, and retain the structured caller identity hint. Explain server-owned source binding authorization in help and README. Pin local-only success and refusal behavior, safe paths, overwrite consent, quoting and secret-safe errors. Validation: full CLI gate, 449 passing tests, package verification and real proof-cli plugin smoke. Tested tree ee7dc81. Package version remains 0.17.0; npm publication belongs to the release owner.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
proof liskov application runtime-image workflownow generates a caller for the releasedruntime-image.yml@v2workflow from a registered V5 source/native_image JSON document. It validates the document and authored digest through the bundled policy client, refuses V4 and pinned releases, and replaces the obsolete V4 builder requirement with guidance for the server-owned source binding. The structuredpolicyWorkflowRefHintkey remains compatible.Regression coverage pins local-only generation, refusal without output or network calls, safe paths, overwrite consent, YAML quoting, and secret-safe errors. Help and README explain the Internal native-image path and the binding authorization required at dispatch.
Refs BKLG-20261013-6kzp; ADR-0068.
Validation recorded by implementation and independently rerun by review on commit
60c659acf3320b0759c899fa909d569bb1bc9230, treeee7dc815a387f9f0b220d7a0988ff65a6f7ecd85:pnpm install --frozen-lockfile,pnpm typecheck,pnpm test(449 passing), andpnpm build.node scripts/verify-package.mjs,pnpm pack:dry-run, andpnpm smoke:proof-pluginwith the real root proof CLI.Package version remains 0.17.0; npm publication belongs to the release owner.