v30.3-roots.1 · Commit 8: [PATCH 08/68] ci: restore Roots assurance on Core 30.3 interfaces
contrib/roots/README.md
Before: contrib/roots/README.md · After: contrib/roots/README.md
File metadata
index df403a466e4a989d7301650dcd82cd0e0af79214..0a0ce8fab5e6a4f5f5c411aa1cb7d0f59bffa893 100644
Download original patch · Release notes
Diff rows 1–14 of 14. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
contrib/roots/README.md
CHANGED
|
@@ -243,8 +243,12 @@ GitHub Actions tag workflows check out the tagged commit; a release tag does not
|
|
|
243
243
|
need to be reachable from `main`. Release validation instead requires the tag
|
|
244
244
|
target to match its canonical `roots/<core-version>` branch. The release patch
|
|
245
245
|
is generated from the Core tag and canonical commits at release time and is not
|
|
246
|
-
checked into the repository. Do not create nightly, promotion, or
|
|
247
|
-
generated-evidence control planes around this workflow.
|
|
246
|
+
checked into the repository. It deliberately excludes `.github/**`: Roots'
|
|
247
|
+
GitHub Actions and repository-management files remain in the canonical branch
|
|
248
|
+
and release tag, while the portable patch contains the product code, build
|
|
249
|
+
support, documentation, and source tests. Replay verification requires every
|
|
250
|
+
path outside `.github/**` to match the release tag and confirms that the patch
|
|
251
|
+
leaves Core's own `.github/**` tree unchanged.
|
|
248
252
|
|
|
249
253
|
Before pushing a tag, the patch artifact can be generated and replay-verified
|
|
250
254
|
locally without adding it to Git:
|