beardthelion ab0a32ef4f ci(release): pin the verified commit and the exact asset bytes end to end ...

The provenance checks ran at resolve time but the consumers re-resolved
mutable names afterward, leaving a move-the-tag or replace-the-asset race:

- Checkouts now use the commit SHA the resolver emitted (tag_commit),
  falling back to the qualified tag ref.
- The resolver captures the release's name/id asset pairs once, checks all
  uploaders against them, and the lay-in step downloads by asset id. An
  asset deleted and reuploaded between resolve and download gets a new id
  and fails closed.
- The npm-publish comment now names the third trusted-publisher component
  (environment), which is what binds the OIDC token to the gate.

2026-09-13 09:11:41 -05:00

..

build-bins.sh

ci: declare the lock-sync toolchain and extend --locked to the shipping builds

2026-07-28 16:28:27 -05:00

build-macos-app.sh

feat: macOS menu bar app for managing gitlawb-node Docker Compose stack (#8)

2026-05-27 09:37:36 +08:00

check-gitlawb-core-deps.sh

ci: declare the lock-sync toolchain and extend --locked to the shipping builds

2026-07-28 16:28:27 -05:00

check-release-versioning.sh

fix(release): scope the annotation check to the [package] table

2026-08-03 09:45:17 -05:00

resolve-release-tag.sh

ci(release): pin the verified commit and the exact asset bytes end to end

2026-09-13 09:11:41 -05:00

test-resolve-release-tag.sh

ci(release): pin the verified commit and the exact asset bytes end to end

2026-09-13 09:11:41 -05:00