eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Version and bind module build receipts

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-10 03:16:40 +00:00
parent 926b74bc0b
commit d06b62efe2
7 changed files with 225 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/consumers/build.md
View File

@@ -83,6 +83,8 @@ points inside the source tree.
For delivery from a tagged checkout, `deliver` builds selected tagged-source
targets into temporary storage by default. Use `--assets DIR` to deliver a
separate build output; ReleaseKit requires its receipt and verifies the source,
build settings, and artifact hashes before the first Gitea write. See the
separate build output; ReleaseKit requires the current module-bound receipt and
checks its source identity and normalized build settings. It verifies artifact
bytes and sizes during delivery before the first Gitea write. Older receipts
must be regenerated with the updated `build` command. See the
[delivery consumer guide](delivery.md) for page-only delivery and retry states.

8
docs/consumers/delivery.md
View File

@@ -89,9 +89,11 @@ RELEASEKIT_GITEA_TOKEN="$GITEA_TOKEN" releasekit deliver --assets dist v1.2.3
The build command does not need delivery credentials. The `--assets DIR`
directory must contain the private `.releasekit-build.json` receipt created by
`build`. ReleaseKit checks the receipt's repository, commit, version, resolved
module directory and path, full tag, build settings, and file hashes before
making a remote request; caller-owned files remain available for retries.
`build`. ReleaseKit checks its schema, repository, commit, version, resolved
module directory and path, full tag, normalized build settings, and artifact
declarations. Old receipts must be regenerated with the updated `build`
command. Delivery verifies the artifact bytes and sizes before making a hosted
request; caller-owned files remain available for retries.
Ordinary `deliver` does not download application dependencies or change the
checkout.

9
docs/roadmap/implementation.md
View File

@@ -499,6 +499,15 @@ changed or missing artifact bytes fails during delivery before hosted requests.
Protect verification ownership through an observable read boundary rather than
tests tied to private helper choreography. Run receipt and CLI prebuilt tests.
**Completed:** Replaced the unversioned receipt with schema version 1 and pure
recorded-identity checks for module path, physical directory, version, and full
tag. Receipt loading now validates structure and normalized settings without
opening artifacts; delivery remains responsible for verifying artifact bytes
and sizes before hosted requests. Old and unknown schemas require regeneration.
Verified root and nested receipts, malformed identity and settings, changed and
missing artifacts, `go test ./...`, `go run ./internal/apicheck`, and
`git diff --check`.
## Stage 10: Map profiles and product commands to module operations
**Outcome:** Local check, publication, and build commands express the new API with