CI/CD: publish verified Profile A release artifacts #13

New issue

Open

opened 2026-08-03 08:16:21 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-03 08:16:21 +00:00

(Migrated from github.com)

Depends on

Goal

Add a gated delivery pipeline for reproducible Profile A releases after the library and native transport packages exist. CI must remain offline from Discord; CD must publish only artifacts produced from a clean, pinned, fully validated revision.

Scope

trigger release verification from signed/versioned tags and an explicit dry-run workflow dispatch
run the complete Nix, ASDF, native, replay, compatibility, and integration check set before publishing
build libcldiscordcurl and cl-discord-self as separate reproducible artifacts
verify the production closure excludes Python and live credentials
generate checksums, source revision metadata, compatibility-manifest digest, and build provenance
publish GitHub release artifacts only after all release gates pass
keep release credentials least-privilege and use repository-scoped GitHub permissions
pin third-party workflow actions to reviewed immutable revisions

Constraints

no release workflow may contact Discord or require an account token
no automatic release from an unreviewed branch
no mutable dependency resolution during release
no artifact publication when the worktree, lockfile, generated models, or compatibility manifest drift
no claim that a platform is supported unless its artifact was built and checked

Exit gate

a dry run produces identical artifact digests from the same revision
a tag pipeline refuses dirty, unlocked, or failing inputs
published artifacts include checksums and exact source/compatibility revisions
GitHub token permissions are minimal and publication is isolated from pull-request workflows
rollback and failed-release behavior are documented

## Depends on - #8 ## Goal Add a gated delivery pipeline for reproducible Profile A releases after the library and native transport packages exist. CI must remain offline from Discord; CD must publish only artifacts produced from a clean, pinned, fully validated revision. ## Scope - trigger release verification from signed/versioned tags and an explicit dry-run workflow dispatch - run the complete Nix, ASDF, native, replay, compatibility, and integration check set before publishing - build `libcldiscordcurl` and `cl-discord-self` as separate reproducible artifacts - verify the production closure excludes Python and live credentials - generate checksums, source revision metadata, compatibility-manifest digest, and build provenance - publish GitHub release artifacts only after all release gates pass - keep release credentials least-privilege and use repository-scoped GitHub permissions - pin third-party workflow actions to reviewed immutable revisions ## Constraints - no release workflow may contact Discord or require an account token - no automatic release from an unreviewed branch - no mutable dependency resolution during release - no artifact publication when the worktree, lockfile, generated models, or compatibility manifest drift - no claim that a platform is supported unless its artifact was built and checked ## Exit gate - a dry run produces identical artifact digests from the same revision - a tag pipeline refuses dirty, unlocked, or failing inputs - published artifacts include checksums and exact source/compatibility revisions - GitHub token permissions are minimal and publication is isolated from pull-request workflows - rollback and failed-release behavior are documented