Make cross-configuration validation deterministic

2026-09-05 03:37:00 +00:00
parent 0d4d71b9dc
commit 5b62a8d60d
5 changed files with 35 additions and 5 deletions
--- a/internal/config/validate_core.go
+++ b/internal/config/validate_core.go
@@ -139,7 +139,8 @@ func validateCrossConfig(pipeline *PipelineConfig, session *SessionConfig, stabl
 		return nil
 	}
 	if pipeline.Notarius != nil && pipeline.Notarius.Enabled {
-		for selector, source := range pipeline.Notarius.References {
+		for _, selector := range sortedStringKeys(pipeline.Notarius.References) {
+			source := pipeline.Notarius.References[selector]
 			if source == artifactpolicy.SourceInputSpellCatalog && strings.TrimSpace(stableInputs.SpellCatalogFile.Path) == "" {
 				return fmt.Errorf("pipeline.notarius.references.%s requires campaign.inputs.spell_catalog_file or session.inputs.spell_catalog_file", selector)
 			}