Skip to content

flow: approve evidence folders once in the public artifact check - #1462

Merged
abrichr merged 2 commits into
mainfrom
ci/approved-public-folders
Oct 21, 2026
Merged

abrichr merged 2 commits into
mainfrom
ci/approved-public-folders

Conversation

@abrichr

@abrichr abrichr commented Oct 20, 2026

Copy link
Copy Markdown
Member

Every pull request that added an evidence file had to add a row to packages/flow/public-artifacts.json. Parallel PRs then conflicted on that list, which is what blocked #1438, #1433 and #1435.

  • Approved folders. Artifact-type files inside these folders pass without a row: benchmark/{auto_repair,openemr_api_tier,run_player,scoreboard,silent_saves}/, the four docs/showcase*/ folders, public-demo/evidence-packs/, registry/bundles/ and tests/fixtures/. The list drops from 2,493 rows to 239.
  • Still per file everywhere else. Under benchmark/ only results folders are approved. Elsewhere there, the row is what catches a renamed raw-results or recipe file (test_public_source_tree_excludes_private_data_and_recipes).
  • Unchanged. Forbidden categories, private-corpus signatures, the secret scan and the license checks still apply to every file. --stamp-release-inventory now lists and hashes approved-folder files too, so the wheel and sdist checks still pin every shipped artifact's bytes.

Tests: the release contract, validate-claims and source-policy tests pass (111), including a new test. In it, a file in an approved folder passes and is stamped with its checksum, and a file in a new benchmark folder is still refused.

🤖 Generated with Claude Code

Files of an artifact type inside the approved evidence folders (benchmark
results, showcase, evidence packs, bundles, test fixtures) no longer need a row
in public-artifacts.json, so pull requests that add evidence stop editing and
colliding on that list. Everywhere else a row per file is still required; under
benchmark/ only result folders are approved, because the row is what catches a
renamed raw-results or recipe file there. The content checks are unchanged, and
the release stamp still lists and hashes every approved file, so shipped
archives pin their bytes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@abrichr
abrichr enabled auto-merge October 20, 2026 22:53
@abrichr
abrichr added this pull request to the merge queue Oct 20, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Oct 20, 2026
…lders

# Conflicts:
#	packages/flow/public-artifacts.json
@abrichr
abrichr enabled auto-merge October 20, 2026 23:45
@abrichr
abrichr added this pull request to the merge queue Oct 21, 2026
Merged via the queue into main with commit 0669c4b Oct 21, 2026
39 checks passed
@abrichr
abrichr deleted the ci/approved-public-folders branch October 21, 2026 00:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant