Merge pull request #41 from NDDev-OpenNetwork/fix/release-semantics-070

fix(release): preserve worktree and prerelease identity

Author: rldyourmnd

.gds/bundle.lock.yaml

@@ -5,14 +5,14 @@ bundle:
   version: "0.4.0-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:48f2b1985e221205b7f0528948ff7dd7483b332f11afc33ca0f118af6eaf3554"
-  digest: "sha256:1463b23f250b5204041dd4f5de12c3a390f8a9a84b38e46c0a01d0e3eee9af8a"
+  source_tree_digest: "sha256:1aa9237afbbce4e74a7e2580ad22601a8ce2c2c5046cb797e6cfc82aa8320e2d"
+  digest: "sha256:eda29a8be938e2ea6dd85b28b9e0bb30cec155ea31386cfd2b043ce8b959cc66"
 
 projection:
-  input_digest: "sha256:453a5f58141f6206c3fe136e56c193275d7eade3ccb1e30fd6aa555f5a93cef8"
-  output_digest: "sha256:4dbaf721de0e61c8429766bf4449a31635eccd1ab179d1ff996c15fa33310b6a"
+  input_digest: "sha256:491245684963cbacff4fe8c5c3b828b5f367b08bda217a264d7617b592cfeff3"
+  output_digest: "sha256:be645e1600d99a870a126567eb5ec2690c3faec7664d8196eebdea567b458d1c"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:932c2ba6b4db499a2e7549ab9ee46085a7fa386f34b5b3a1837c93487eef119c"
+      digest: "sha256:3994ebccb515b10763ecbe69b4a31fc8e34a09adf7e5543a10c8716b761e4e1c"

.github/workflows/gds-ci.yml

@@ -1,8 +1,8 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.4.0-dev
-# source-tree-digest: sha256:48f2b1985e221205b7f0528948ff7dd7483b332f11afc33ca0f118af6eaf3554
-# input-digest: sha256:453a5f58141f6206c3fe136e56c193275d7eade3ccb1e30fd6aa555f5a93cef8
+# source-tree-digest: sha256:1aa9237afbbce4e74a7e2580ad22601a8ce2c2c5046cb797e6cfc82aa8320e2d
+# input-digest: sha256:491245684963cbacff4fe8c5c3b828b5f367b08bda217a264d7617b592cfeff3
 # output-digest: sha256:c268237f2cffde69b7868265ba6ac331048c98036fb9030ee7b7b3a208a9ad49
 # edit-source:
 #   - .gds/repository.yaml

.github/workflows/release-bundle.yml

@@ -330,13 +330,67 @@ jobs:
           RELEASE_CHANNEL: ${{ inputs.channel }}
         run: |
           set -euo pipefail
-          latest_flags=()
-          [ "$RELEASE_CHANNEL" = "stable" ] && latest_flags=(--latest)
+          release_flags=()
+          case "$RELEASE_CHANNEL" in
+            stable) release_flags=(--latest) ;;
+            canary) release_flags=(--prerelease) ;;
+          esac
           gh release create "$RELEASE_TAG" \
             --repo "$GITHUB_REPOSITORY" \
             --title "GDS $RELEASE_TAG" \
             --verify-tag \
-            "${latest_flags[@]}" \
+            "${release_flags[@]}" \
             --notes "Immutable GDS ${RELEASE_CHANNEL} bundle for ${RELEASE_TAG}. Multi-platform binaries + SPDX SBOM + SHA256SUMS, with keyless SLSA build provenance and SBOM attestations. Online: gh attestation verify <asset> -R ${GITHUB_REPOSITORY}. Offline: verify <asset> against provenance.sigstore.json and sbom.sigstore.json using trusted-root.jsonl, all attached here." \
             "$RELEASE_DIRECTORY"/* \
             "$EVIDENCE_DIRECTORY"/*
+
+  record-failure:
+    name: Record failed release evidence
+    needs: [build, attest, publish]
+    if: ${{ always() && startsWith(github.ref, 'refs/tags/') && (needs.build.result == 'failure' || needs.attest.result == 'failure' || needs.publish.result == 'failure') }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_TAG: ${{ github.ref_name }}
+      RELEASE_VERSION: ${{ inputs.version }}
+      RELEASE_SEQUENCE: ${{ inputs.release_sequence }}
+      RELEASE_CHANNEL: ${{ inputs.channel }}
+      BUILD_RESULT: ${{ needs.build.result }}
+      ATTEST_RESULT: ${{ needs.attest.result }}
+      PUBLISH_RESULT: ${{ needs.publish.result }}
+    steps:
+      - name: Publish machine-readable failure envelope
+        shell: bash
+        run: |
+          set -euo pipefail
+          envelope="$RUNNER_TEMP/release-failure-envelope.json"
+          failed_jobs="$RUNNER_TEMP/failed-jobs.json"
+          jq -cn \
+            --arg build "$BUILD_RESULT" \
+            --arg attest "$ATTEST_RESULT" \
+            --arg publish "$PUBLISH_RESULT" \
+            '[{name:"build",result:$build},{name:"attest",result:$attest},{name:"publish",result:$publish}] | map(select(.result == "failure") | .name)' \
+            > "$failed_jobs"
+          jq -n \
+            --arg version "$RELEASE_VERSION" \
+            --argjson sequence "$RELEASE_SEQUENCE" \
+            --arg channel "$RELEASE_CHANNEL" \
+            --arg commit "$GITHUB_SHA" \
+            --arg ref "$GITHUB_REF" \
+            --argjson run_id "$GITHUB_RUN_ID" \
+            --slurpfile failed "$failed_jobs" \
+            '{schema_version:1,status:"failed",bundle_version:$version,release_sequence:$sequence,channel:$channel,source_commit:$commit,source_ref:$ref,workflow_run_id:$run_id,failed_jobs:$failed[0],superseded_by:null}' \
+            > "$envelope"
+          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" "$envelope" --repo "$GITHUB_REPOSITORY"
+          else
+            gh release create "$RELEASE_TAG" \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "GDS $RELEASE_TAG (failed)" \
+              --verify-tag \
+              --prerelease \
+              --notes "Release production failed. See release-failure-envelope.json for machine-readable evidence; retain this tag and release until a later release records it as superseded." \
+              "$envelope"
+          fi

core/bundle/bundle_test.go

@@ -151,6 +151,20 @@ func TestVerifyAttestationAndAntiRollbackPolicy(t *testing.T) {
 		t.Fatalf("exact rollback authorization was not accepted: result=%#v findings=%#v", result, findings)
 	}
 
+	forward := candidate.Envelope
+	forward.ReleaseSequence = 3
+	forward.BundleVersion = "0.9.0"
+	state = AcceptanceState{
+		HighestSequence:  2,
+		AcceptedDigests:  map[int]string{2: digest(bytes.Repeat([]byte{'b'}, 64))},
+		AcceptedVersions: map[int]string{2: "1.0.0"},
+	}
+	result, findings = Verify(forward, testTrust(), evidence, state, nil, now)
+	assertFinding(t, findings, "GDS_BUNDLE_VERSION_REGRESSION")
+	if result.Status != "quarantined" {
+		t.Fatalf("semantic version regression was not quarantined: %#v", result)
+	}
+
 	evidence.Verified = false
 	result, findings = Verify(candidate.Envelope, testTrust(), evidence, AcceptanceState{}, nil, now)
 	assertFinding(t, findings, "GDS_BUNDLE_ATTESTATION_INVALID")

core/bundle/types.go

@@ -150,8 +150,9 @@ type AttestationEvidence struct {
 }
 
 type AcceptanceState struct {
-	HighestSequence int            `json:"highest_sequence"`
-	AcceptedDigests map[int]string `json:"accepted_digests"`
+	HighestSequence  int            `json:"highest_sequence"`
+	AcceptedDigests  map[int]string `json:"accepted_digests"`
+	AcceptedVersions map[int]string `json:"accepted_versions,omitempty"`
 }
 
 type RollbackAuthorization struct {

core/bundle/verify.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/NDDev-OpenNetwork/github-device-sync/core/domain"
+	"github.com/NDDev-OpenNetwork/github-device-sync/core/semver"
 )
 
 func Verify(
@@ -101,6 +102,16 @@ func Verify(
 			"A release sequence is already bound to a different artifact digest.",
 		))
 	}
+	if envelope.ReleaseSequence > state.HighestSequence && state.HighestSequence > 0 {
+		if previous := state.AcceptedVersions[state.HighestSequence]; previous != "" {
+			if compared, valid := semver.Compare(envelope.BundleVersion, previous); !valid || compared < 0 {
+				findings = append(findings, verificationFinding(
+					"GDS_BUNDLE_VERSION_REGRESSION",
+					"A higher release sequence cannot lower Semantic Version precedence.",
+				))
+			}
+		}
+	}
 	status := "accepted"
 	if len(findings) != 0 {
 		status = "quarantined"

core/cli/root_test.go

@@ -1003,6 +1003,8 @@ func commitCLITestRepository(t *testing.T, root string, message string) {
 		{"init", "--quiet"},
 		{"config", "user.name", "GDS CLI test"},
 		{"config", "user.email", "cli-test@example.invalid"},
+		{"config", "gc.auto", "0"},
+		{"config", "maintenance.auto", "false"},
 		{"add", "--all"},
 		{"commit", "--quiet", "-m", message},
 	} {

core/providers/git/status.go

@@ -161,12 +161,6 @@ func (runner *Runner) InspectStatus(ctx context.Context, directory string) (Stat
 	}
 	status.Repository = info
 	status.Worktrees = parseWorktrees(worktreeResult.Stdout)
-	for index := range status.Worktrees {
-		if status.Worktrees[index].Path == info.CommonGitDir &&
-			info.WorktreeRoot != info.CommonGitDir {
-			status.Worktrees[index].Path = info.WorktreeRoot
-		}
-	}
 	status.Submodules = parseSubmodules(submoduleResult.Stdout)
 	status.RemoteFreshness = "unknown"
 	status.Classification = classify(status)

core/providers/git/status_test.go

@@ -278,6 +278,25 @@ func TestInspectStatusDetachedAndMultipleWorktrees(t *testing.T) {
 	if detached.Head.Mode != "detached" || detached.Classification != "detached" {
 		t.Fatalf("detached status = %#v", detached)
 	}
+	paths := map[string]bool{}
+	for _, worktree := range detached.Worktrees {
+		canonical, err := filepath.EvalSymlinks(worktree.Path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		paths[canonical] = true
+	}
+	directory, err = filepath.EvalSymlinks(directory)
+	if err != nil {
+		t.Fatal(err)
+	}
+	linked, err = filepath.EvalSymlinks(linked)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(paths) != 2 || !paths[directory] || !paths[linked] {
+		t.Fatalf("linked worktree paths = %#v, want %q and %q", paths, directory, linked)
+	}
 }
 
 func TestInspectStatusCachedAheadBehindAndDiverged(t *testing.T) {

core/releasebuilder/workflow_contract_test.go

@@ -97,6 +97,10 @@ func TestHostedReleaseWorkflowUsesOutputOutsideSourceRoot(t *testing.T) {
 		`stable/frozen requires signed active-five harness evidence`,
 		`--harness-evidence-directory $EVIDENCE_INPUT_ROOT/records`,
 		`RELEASE_SEQUENCE: ${{ inputs.release_sequence }}`,
+		`canary) release_flags=(--prerelease) ;;`,
+		`name: Record failed release evidence`,
+		`release-failure-envelope.json`,
+		`superseded_by:null`,
 	} {
 		if !strings.Contains(content, required) {
 			t.Fatalf("hosted workflow is missing output contract %q", required)