v30.3-roots.1 · Commit 66: [PATCH 66/68] fix(release): validate notices and reuse proven promotion CI
ci/release/README.md
Before: ci/release/README.md · After: ci/release/README.md
File metadata
index 5764b45fc2a94fea35bf89e14b6ceb387840b20c..7a7080b4dc6ce783a53502826caa7c67aca1127b 100644
Download original patch · Release notes
Diff rows 1–13 of 13. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
ci/release/README.md
CHANGED
|
@@ -1,7 +1,12 @@
|
|
|
1
1
|
# Release notice assembly
|
|
2
2
|
|
|
3
3
|
`release.yml` runs the five-platform pipeline on a permanent Roots tag push;
|
|
4
|
-
manual dispatch rehearses an absent future tag with read-only permissions.
|
|
4
|
+
optional manual dispatch rehearses an absent future tag with read-only
|
|
5
|
+
permissions. The normal release builds once on the tag push, signs/creates a
|
|
6
|
+
draft and independently verifies it before separate publication approval.
|
|
7
|
+
Manual rehearsal is not required, cannot run against an existing remote tag,
|
|
8
|
+
and does not establish binary reproducibility. Source corrections require
|
|
9
|
+
renewed review/CI and affected build evidence.
|
|
5
10
|
Both paths capture notices from each new build runner before packaging. Only
|
|
6
11
|
the tag path enters the `release` environment and requires a signed manifest
|
|
7
12
|
before creating a new draft. Public publication remains a separate approval.
|