eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Regenerate local artifacts and invalidate stale receipts

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-06 00:56:44 +00:00
parent b744346210
commit b4d348dd1f
9 changed files with 90 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/cli.md
View File

@@ -60,10 +60,11 @@ go run ./cmd/releasekit build [--repo DIR] [--config FILE] [--output DIR] VERSIO
targets with the requested version injected, checks the native `version`
invocation, and writes binaries plus the private `.releasekit-build.json`
receipt into `dist` by default. `--output` selects a different directory;
relative paths are resolved from the repository. Existing files with a selected
artifact name are preserved and cause an error. A complete nonempty build
relative paths are resolved from the repository. Selected artifact filenames
are regenerated while unrelated files are preserved. A complete nonempty build
writes a receipt only after compilation and smoke checking succeed. On partial
failure, standard error lists completed outputs and no receipt is written. An
failure, standard error lists completed outputs and prior receipts in that
output directory are invalidated; no new receipt is written. An
empty target list returns the source commit without building or writing a
receipt.

5
docs/consumers/build.md
View File

@@ -46,9 +46,8 @@ source and the same HEAD before and after compilation; binary delivery requires
that fact. This observation is not a source snapshot or attestation guarantee.
The default output directory is `<repository>/dist`; a relative `OutputDir` is
resolved from the repository. Existing files with a selected artifact name are
preserved and cause an error. Other files in the output directory are left in
place. A failed later build or native version check returns the binaries already
resolved from the repository. Selected artifact filenames are regenerated. Other files in the output
directory are left in place. A failed later build or native version check returns the binaries already
generated in `BuildResult.Artifacts`.
Builds use the prepared local Go toolchain, readonly module mode, disabled

8
docs/roadmap/remediation.md
View File

@@ -163,6 +163,8 @@ write outcomes. Both affected suites pass.
### R4 — Medium: Local artifact regeneration is prohibited
Status: Resolved.
Category: Inadvertently strengthened prohibition.
**Evidence:** [Build](../../internal/build/build.go), around line 114, refuses
@@ -188,6 +190,12 @@ machinery.
a changed local build can regenerate its owned names; unrelated files survive;
a partial rebuild does not authorize incomplete assets through a stale receipt.
**Resolution:** Builds regenerate selected local artifact names and preserve
unrelated output files. The CLI invalidates prior receipts once a rebuild has
reached its output directory, including failed rebuilds. API regressions cover
repeated and changed-source builds; CLI coverage proves a failed smoke check
removes the previous receipt. Affected suites pass.
### R5 — Medium: The root facade still owns release mechanics
Category: Architectural ownership gap and maintainability.