Skip to content

fix(ci): restore reachable provenance inputs for the visual catalog - #20

Merged
zoeyrose merged 2 commits into
mainfrom
fix/resources-19-provenance-inputs
Aug 24, 2026
Merged

fix(ci): restore reachable provenance inputs for the visual catalog#20
zoeyrose merged 2 commits into
mainfrom
fix/resources-19-provenance-inputs

Conversation

@zoeyrose

Copy link
Copy Markdown
Member

Summary

Restore reachable, verified provenance inputs for the visual catalog and make historical Git LFS reads fail closed.

Implementation / behavior

  • Keep catalog provenance tied to repository-owned commits, paths, authorship, and payload hashes.
  • Resolve historical Git objects and LFS payloads by verified identity, with diagnostics for missing evidence.
  • Validate every catalog revision, path, and payload before generation and package publication.

Validation

  • tools/validate.sh
  • Two deterministic package builds and checksum verification
  • Pinned Classic and Content source validation

Closes #19

@zoeyrose
zoeyrose marked this pull request as ready for review August 24, 2026 02:43
@zoeyrose
zoeyrose merged commit e792037 into main Aug 24, 2026
6 checks passed
@zoeyrose
zoeyrose deleted the fix/resources-19-provenance-inputs branch August 24, 2026 02:52
@github-actions

Copy link
Copy Markdown

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(ci): restore reachable provenance inputs for the visual catalog

1 participant