vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-19 02:28:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

Complete release and helper download safeguards

Browse source
This commit is contained in:
pulse-triage[bot] 2026-08-30 00:41:58 +01:00
parent 718de25b2b
commit ac2a2fe020
6 changed files with 55 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/release-control/v6/internal/subsystems/deployment-installability.md
View file

@ -4522,3 +4522,10 @@ the customer-promotion lease or mutate a floating image tag, Helm index,
paid-runtime pointer, or live environment until the check passes. Repository
release immutability must therefore be enabled before merging or running this
activation path.
Attestation policy decisions require GitHub CLI 2.97.0 or newer so signer
repository and workflow names are matched literally. The shared verifier must
also bind the downloaded `checksums.txt` bytes to the immutable release and to
SLSA v1 provenance from the exact `create-release.yml` workflow and expected
source SHA. Multi-asset download retries clear both the activation marker and
checksum manifest first so a partial attempt cannot poison every later retry.