docs(sources): integrate the reviewed release prerequisites - #134
Merged
Conversation
`GDS_SOURCE_REVIEW_OVERDUE` failed the release gate for gds-v0.9.1: two claims
passed their review date on 2026-09-10.
Both were reviewed rather than re-dated.
`github-cli-attestation-verifier` — `gds source check` reports the pinned
digest still matches the published gh 2.97.0 checksums file, so the claim is
unchanged and only its dates move.
`github-repository-immutable-releases` — the source content did change
(`GDS_SOURCE_CONTENT_CHANGED`, 90916 bytes), so the three governed claims were
checked against the current documentation. All three still hold: the
repository-scope endpoints are still `GET`, `PUT` and `DELETE
/repos/{owner}/{repo}/immutable-releases`, and organization-level enforcement
still exists with an all-or-selected repository scope, which is what
`remediation.go:376` relies on when it refuses to disable an owner-enforced
setting at repository scope. The digest is re-pinned to what was verified,
a53d404d, rather than left naming content nobody read.
`gds source mark-verified` could not be used for either: run inside this
repository it refuses with GDS_CONTROL_PLANE_ROLE_REQUIRED, and run from the
control plane it refuses with GDS_SOURCE_REGISTER_NOT_PROVEN, because the
register lives here and the role does not. Reported separately; the values
written here are the ones that command would have written.
Claude-Session: https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release production is blocked by two source claims whose review dates expired on September 10. Integrate the existing reviewed updates for the GitHub CLI attestation verifier and repository immutable releases documentation, including the changed documentation digest.
Validation: Go tests for core/source, core/cli and core/app pass with go1.26.7. The CLI checksum manifest was downloaded again and matches the registered digest. This repairs source freshness; the failed release identity remains unchanged and will be superseded by a later verified release.