From c1213dad08f940404dfccc749fcb5bf2064b1228 Mon Sep 17 00:00:00 2001 From: ekklesia Date: Wed, 14 Oct 2026 00:05:15 -0500 Subject: [PATCH] ci: pin the platform harness to the released Core v0.2.5 Integration still fetched Core at PR #92's head (5e9433d): the right pin while that PR was in review, but it predates #94 (display credential renewal) and #93 (the registry move), both in v0.2.5. Signage now proves itself against the release it will run on. The pin contract also accepts a release tag (refs/tags/vX.Y.Z) alongside a pull request head or main, and the fetch compares the ref's commit (^{commit}) so an annotated tag pins the same way a lightweight one does. v0.2.5 is lightweight; that should not be a hidden requirement. Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/ci.yml | 2 +- ci/check-cleanup.sh | 4 ++-- ci/fetch-platform.sh | 2 +- ci/platform.env | 9 +++++---- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index cfcdf36..369a197 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -3,7 +3,7 @@ name: CI # Signage is a standalone repository: every job installs it with --frozen-lockfile from its own # pnpm-lock.yaml and takes Ekklesia's module-development packages (@ekklesia/*) from Ekklesia's # public package registry (.npmrc; platform ADRs 0053 and 0054). Only the integration job fetches -# Core source: one immutable commit through the pinned Gitea pull ref in ci/platform.env, used as the +# Core source: one immutable commit through the pinned Gitea ref in ci/platform.env, used as the # generic deployment harness and image source, never as a workspace dependency. # # The same trust rules as the platform's own CI (docs/development/security.md there): diff --git a/ci/check-cleanup.sh b/ci/check-cleanup.sh index 8f0089d..a92ec71 100755 --- a/ci/check-cleanup.sh +++ b/ci/check-cleanup.sh @@ -40,9 +40,9 @@ check '[[ -n "$own" && -n "$run" ]] && ((own > run)) && ((own > last_step))' \ check 'sed -n "${last_step},\$p" <<<"$job" | grep -q "if: always()"' "that last step always runs" check 'grep -q "EKKLESIA_SMOKE_MODULE_RELEASE_DIR" "$root/ci/integration.sh" && grep -q "bash scripts/smoke-deploy.sh" "$root/ci/integration.sh"' \ "the integration delegates its external package to the platform smoke" -check 'grep -Eq "^EKKLESIA_PLATFORM_REF=refs/(pull/[0-9]+/head|heads/main)$" "$root/ci/platform.env" && grep -Eq "^EKKLESIA_PLATFORM_COMMIT=[0-9a-f]{40}$" "$root/ci/platform.env"' \ +check 'grep -Eq "^EKKLESIA_PLATFORM_REF=refs/(pull/[0-9]+/head|heads/main|tags/v[0-9]+\.[0-9]+\.[0-9]+)$" "$root/ci/platform.env" && grep -Eq "^EKKLESIA_PLATFORM_COMMIT=[0-9a-f]{40}$" "$root/ci/platform.env"' \ "the platform harness is pinned by full ref and commit" -check 'grep -q "rev-parse refs/remotes/pinned" "$root/ci/fetch-platform.sh" && grep -q "does not resolve to EKKLESIA_PLATFORM_COMMIT" "$root/ci/fetch-platform.sh"' \ +check 'grep -qF "rev-parse \"refs/remotes/pinned^{commit}\"" "$root/ci/fetch-platform.sh" && grep -q "does not resolve to EKKLESIA_PLATFORM_COMMIT" "$root/ci/fetch-platform.sh"' \ "the fetch verifies that the pinned ref resolves to the pinned commit" # Normal CI builds the canonical archive once and hands those exact bytes to integration through a diff --git a/ci/fetch-platform.sh b/ci/fetch-platform.sh index 3ac82cf..56263b5 100755 --- a/ci/fetch-platform.sh +++ b/ci/fetch-platform.sh @@ -32,7 +32,7 @@ git -C "$out" init --quiet git -C "$out" remote add origin "$repository" git -C "$out" fetch --quiet --no-tags --depth=1 origin "+${ref}:refs/remotes/pinned" || fail "cannot fetch the pinned platform ref." -[[ "$(git -C "$out" rev-parse refs/remotes/pinned)" == "$commit" ]] || +[[ "$(git -C "$out" rev-parse "refs/remotes/pinned^{commit}")" == "$commit" ]] || fail "the pinned ref does not resolve to EKKLESIA_PLATFORM_COMMIT." git -C "$out" -c advice.detachedHead=false checkout --quiet --detach "$commit" rm -rf "$out/.git" diff --git a/ci/platform.env b/ci/platform.env index 3f3148f..0a3e96c 100644 --- a/ci/platform.env +++ b/ci/platform.env @@ -1,5 +1,6 @@ -# The companion Core harness Signage uses to install and run its real external package. The pull ref -# remains reachable after its branch is deleted; the full commit pin makes the checkout immutable. +# The companion Core harness Signage uses to install and run its real external package: a released +# Core, by its tag. A pull request's ref (refs/pull/N/head) is used only while Signage depends on a +# Core change still in review. The full commit pin makes the checkout immutable either way. EKKLESIA_PLATFORM_REPOSITORY=https://git.zayin.net/Zayin/Ekklesia.git -EKKLESIA_PLATFORM_REF=refs/pull/92/head -EKKLESIA_PLATFORM_COMMIT=5e9433d96b413117374a6132d89400867414c2c8 +EKKLESIA_PLATFORM_REF=refs/tags/v0.2.5 +EKKLESIA_PLATFORM_COMMIT=437720f2286e962829f2ec8c1c6137ea24f87b9f