eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Bind delivered binaries to verified build source

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-06 00:51:56 +00:00
parent 1d6611601c
commit a1ee067b53
11 changed files with 154 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/consumers/build.md
View File

@@ -40,7 +40,10 @@ func build(ctx context.Context) error {
version into `buildinfo.Version`, and returns the compiler identity, normalized
targets, artifact paths, filenames, and SHA-256 digests. Names follow
`<binary>-<version>-<goos>-<goarch>`; Windows targets add `.exe`. A repeated
target pair is built once, at its first position.
target pair is built once, at its first position. Local builds may use modified
source. `SourceVerified` is true only after a complete build observes clean
source and the same HEAD before and after compilation; binary delivery requires
that fact. This observation is not a source snapshot or attestation guarantee.
The default output directory is `<repository>/dist`; a relative `OutputDir` is
resolved from the repository. Existing files with a selected artifact name are

5
docs/consumers/delivery.md
View File

@@ -54,7 +54,10 @@ understood. The command does not run candidate checks or publish tags.
Pass the Gitea credential explicitly. A `BuildResult` may be supplied for a
binary-producing release; it must identify the same tagged repository commit
and selected version, and its local artifacts must still match their digests.
and selected version, its `SourceVerified` field must confirm the completed
build's clean, unchanged source observations, and its local artifacts must still
match their digests. Cleaning the checkout after a dirty build does not make
that build eligible for delivery.
Leave `Build` nil for a source-only release.
```go