From b65fd6d102a974bc19489ba78c734f6bffdf77bc Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Fri, 11 Sep 2026 05:20:50 +0500 Subject: [PATCH] docs(sources): review the two claims that blocked every release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `GDS_SOURCE_REVIEW_OVERDUE` failed the release gate for gds-v0.9.1: two claims passed their review date on 2026-09-10. Both were reviewed rather than re-dated. `github-cli-attestation-verifier` — `gds source check` reports the pinned digest still matches the published gh 2.97.0 checksums file, so the claim is unchanged and only its dates move. `github-repository-immutable-releases` — the source content did change (`GDS_SOURCE_CONTENT_CHANGED`, 90916 bytes), so the three governed claims were checked against the current documentation. All three still hold: the repository-scope endpoints are still `GET`, `PUT` and `DELETE /repos/{owner}/{repo}/immutable-releases`, and organization-level enforcement still exists with an all-or-selected repository scope, which is what `remediation.go:376` relies on when it refuses to disable an owner-enforced setting at repository scope. The digest is re-pinned to what was verified, a53d404d, rather than left naming content nobody read. `gds source mark-verified` could not be used for either: run inside this repository it refuses with GDS_CONTROL_PLANE_ROLE_REQUIRED, and run from the control plane it refuses with GDS_SOURCE_REGISTER_NOT_PROVEN, because the register lives here and the role does not. Reported separately; the values written here are the ones that command would have written. Claude-Session: https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX --- docs/source-register/sources.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/source-register/sources.yaml b/docs/source-register/sources.yaml index aaac1ee..c647d44 100644 --- a/docs/source-register/sources.yaml +++ b/docs/source-register/sources.yaml @@ -516,8 +516,8 @@ sources: authority: official-source-repository url: https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_checksums.txt volatility: high - verified_at: "2026-08-10" - next_review: "2026-09-10" + verified_at: "2026-09-11" + next_review: "2026-10-11" status: release-checksums-verified-runtime-not-proven content_digest: sha256:61905c69ec8660f310814ec98395cdd0c2d07aabf024c597ec45813984a02334 governs: @@ -589,10 +589,10 @@ sources: authority: official url: https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10 volatility: high - verified_at: "2026-08-10" - next_review: "2026-09-10" + verified_at: "2026-09-11" + next_review: "2026-10-11" status: current-docs-verified-runtime-observed - content_digest: sha256:60ea96392c5aa8d65c6c3aac84ea6c4b0fef23a56f6bf5bce631afc85d59a913 + content_digest: sha256:a53d404d83b90a79de207067fba2d18f9b316ab527326f98ef5cc16c11021c23 governs: - github.immutable-releases-observation - github.immutable-releases-mutation