feat: stable release gates and integration evidence#488
Closed
feat: stable release gates and integration evidence#488
Conversation
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
jithinraj
changed the title
Wire all 4 DD-90 stable-only gates in run-gates.sh with real implementations (perf-benchmarks, ssrf-suite, fuzz-suite, integration-evidence). Add integration evidence infrastructure: - Structured JSON source with immutable pointers (commit SHAs, test file paths, spec refs) - JSON Schema (2020-12) validated via Ajv - Node validator with schema, pointer, and parity checks - Markdown generated from JSON with drift detection - 18 validator tests Add release verification and security posture docs. Add public-artifact linter and PR metadata CI workflow. Add test:property canonical script (11 files).
jithinraj
force-pushed
the
feat/dd90-stable-gates
branch
from
5b59b45 to
2cf5283
Compare
jithinraj
changed the title
Add commit-msg hook reading local denylist for non-technical language. Add hidden Unicode and MEMORY.md checks to public-artifact linter. Update PR metadata CI workflow to generic-only checks (no code checkout). Update PR template with technical-only sections. Make pre-commit planning-leak check conditional (local-only script).
Guard scripts that check for typos must exclude other scripts that also check for the same patterns: commit-msg hook, public-artifact linter, and PR metadata CI workflow.
7 tasks
Member
Author
|
Replaced by #489 (clean single-commit branch with public-artifact hygiene guards). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Wire all 4 stable-only gates in
run-gates.shand add machine-verifiable integration evidence infrastructure.perf-benchmarks: runstests/perf/wire02-slo.test.tsssrf-suite: runs SSRF expansion + no-fetch audit testsfuzz-suite: runspnpm test:property(11 files, 185 property/fuzz tests)integration-evidence: runsnode scripts/release/validate-adoption-evidence.mjsIntegration evidence
docs/adoption/integration-evidence.json): canonical data with PR numbers, commit SHAs, test file paths, spec refsdocs/adoption/integration-evidence.schema.json): validated via Ajv 2020-12scripts/release/validate-adoption-evidence.mjs): validates schema, checks test_files and spec_refs exist on disk, verifies pr_commit hex SHA format, enforces confirmation field requirementsintegration-evidence.mdgenerated from JSON; parity check fails on drift (--generateto regenerate)tests/release/adoption-evidence-validator.test.ts)Also in this PR
docs/VERIFY-RELEASE.md: release verification guide (current vs target OIDC state,--write-release-artifactsauthoritative path)docs/maintainers/SECURITY-POSTURE.md: current/transition/target OIDC separationpackages/adapters/eat/README.md: committed (was untracked).github/workflows/pr-metadata-lint.yml: CI check for PR title/body (guards against non-technical language in PR metadata)scripts/check-public-artifacts.mjs: public artifact linter (commit messages, staged files, PR body files)scripts/guard.sh: added SECURITY-POSTURE.md and VERIFY-RELEASE.md to allowlistscripts/release/run-gates.sh: planning-leak gate now conditional (local-only script)package.json: addedtest:propertycanonical scriptvitest.config.ts: addedtests/release/to include pathsTest plan
node scripts/release/validate-adoption-evidence.mjsvalidates evidence structurenode scripts/release/validate-adoption-evidence.mjs --generateregenerates markdown from JSONpnpm run test:propertypasses (185 tests, 11 files)pnpm exec vitest run tests/release/adoption-evidence-validator.test.tspasses (18 tests)bash scripts/guard.shpassesnode scripts/check-public-artifacts.mjs --no-staged --no-commit-msgpasses