Repository navigation
Stage Go1.27.2 authority for provider CI - #202
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The trusted provider CI policy tool is pinned to Go1.26.4. Stage the exact future CI context for Go1.27.2 so the following adoption can pass the existing trusted-base executable checks.
This changes only the four presence/action/command/executable trust manifests and their existing 46-file recovery guard digest. All current active groups remain unchanged; the future context binds the reviewed new wrapper hash and unchanged harness. No workflow, runtime dependency, analyzer, wrapper or credential authority changes in this stage.
Validation: both independent security and antagonistic source reviews cover the actual five-file freeze. The unchanged native checker/wrapper legal stage→adopt→promote chain and genuine rejection controls passed in PR201 at tested merge0d75a9ec425581b9776bf2d2be6d8c496b89d38b (Go1.27.2, unfiltered root race tests). This PR's own eight exact-head hosted checks are now terminal SUCCESS. CI run37998914649/job114051895249 actually tested merge
bd080251ba5f8f8cd81f2606653dc657510b912ainto accepted075c at head8872bd3fa5ae4021af5127c39188cc87a59ca494. Unfiltered root race tests1.210s and internal race81.078s, vet and the complete public-policy fixtures passed. Its active root compiler remains observedGo1.26.5; the separate trusted policy job114051897356 remains observedGo1.26.4, as expected before adoption. Existing main protection requires one formal approval and enforces administrators; GitHub reports REVIEW_REQUIRED/reviews[]. Both local source reviews are not formal GitHub approval. No settings exception for this PR is authorized or attempted. It does not claim final provider security, adopted toolchain, release or deployment.Next: after accepted stage, rebase PR201 onto it to adopt the CI setup inputs, isolated module floor and exact wrapper binding; then submit the trust-only promotion. The current stage and adoption’s trusted predecessor still use the old policy compiler. Final acceptance requires actual trusted Go1.27.2 evidence after adoption.