v29.4-roots.4 · Commit 8: [PATCH 08/37] ci: restore assurance and isolate Core fixtures
contrib/roots/README.md
Before: contrib/roots/README.md · After: contrib/roots/README.md
File metadata
index 690911e2a3f3aa57fb462ba200b8b250602d72a4..e7a56e2af192e601ca5b7728564639ccb4cbe88f 100644
Download original patch · Release notes
Diff rows 1–14 of 14. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.
contrib/roots/README.md
CHANGED
|
@@ -243,8 +243,12 @@ GitHub Actions tag workflows check out the tagged commit; a release tag does not
|
|
| 243 |
need to be reachable from `main`. Release validation instead requires the tag
|
| 244 |
target to match its canonical `roots/<core-version>` branch. The release patch
|
| 245 |
is generated from the Core tag and canonical commits at release time and is not
|
| 246 |
-
checked into the repository. Do not create nightly, promotion, or
|
| 247 |
-
generated-evidence control planes around this workflow.
|
|
|
|
|
|
|
|
|
|
|
|
|
| 248 |
|
| 249 |
Before pushing a tag, the patch artifact can be generated and replay-verified
|
| 250 |
locally without adding it to Git:
|
|
|
|
| 243 |
need to be reachable from `main`. Release validation instead requires the tag
|
| 244 |
target to match its canonical `roots/<core-version>` branch. The release patch
|
| 245 |
is generated from the Core tag and canonical commits at release time and is not
|
| 246 |
+
checked into the repository. It deliberately excludes `.github/**`: Roots'
|
| 247 |
+
GitHub Actions and repository-management files remain in the canonical branch
|
| 248 |
+
and release tag, while the portable patch contains the product code, build
|
| 249 |
+
support, documentation, and source tests. Replay verification requires every
|
| 250 |
+
path outside `.github/**` to match the release tag and confirms that the patch
|
| 251 |
+
leaves Core's own `.github/**` tree unchanged.
|
| 252 |
|
| 253 |
Before pushing a tag, the patch artifact can be generated and replay-verified
|
| 254 |
locally without adding it to Git:
|