Bind delivered binaries to verified build source

This commit is contained in:
2026-10-06 00:51:56 +00:00
parent 1d6611601c
commit a1ee067b53
11 changed files with 154 additions and 15 deletions

View File

@@ -54,7 +54,10 @@ understood. The command does not run candidate checks or publish tags.
Pass the Gitea credential explicitly. A `BuildResult` may be supplied for a
binary-producing release; it must identify the same tagged repository commit
and selected version, and its local artifacts must still match their digests.
and selected version, its `SourceVerified` field must confirm the completed
build's clean, unchanged source observations, and its local artifacts must still
match their digests. Cleaning the checkout after a dirty build does not make
that build eligible for delivery.
Leave `Build` nil for a source-only release.
```go