Repository navigation
Pin cpp-FuSa to v0.15.0 instead of floating on unpinned (default branch) #15
Description
This repo's CI currently references cpp-FuSa via unpinned (default branch) rather than an explicit version pin (same cpp-FuSa checkout pattern as cpp-CAN -- add ref: v0.15.0).
This is a reproducibility and stability risk: an upstream change to cpp-FuSa's default branch can silently change or break this repo's CI with no corresponding commit in this repo to explain why.
This is part of an ecosystem-wide policy decision to pin every x-Net repo (all languages) to an explicit, deliberately-upgraded cpp-FuSa version, matching what the Go x-Net repos already do (and are being updated to do consistently, see the parallel go-FuSa v0.36.0 pin-update pass).
Note that pinning to v0.15.0 (today's latest) may surface checks that were not being enforced before, since floating on main meant this repo was already exposed to whatever the newest checks are anyway -- so behavior should be similar, but flag that verification is still required.
This issue will be actioned directly as part of this pass, not left open.
Activity
fix: pin cpp-FuSa checkout to v0.15.0 in CI workflows (#16)
SoundMatt commentedon Jul 28, 2026
Fixed in #16 (merged, auto-closed this issue via "Closes #15").
Searched .github/workflows/*.yml for every cpp-FuSa checkout occurrence — found exactly two, both in ci.yml (the
fusa-asil-bjob and thesarifjob). Pinned both toref: v0.15.0(current latest release at the time of the fix).Verified end-to-end, not just a text edit: pushed the branch and watched CI to a real terminal state. All 15 checks passed, including
cpp-FuSa ASIL-B qualification. Pulled the raw job log for that job directly — confirms the pinned checkout actually fetchedrefs/tags/v0.15.0, cpfusa built from that ref, and the qualify gate output wasRunning qualification suite for cpfusa v0.15.0... Cases: 8 Passed: 8 Failed: 0with no##[error]anywhere in the job. So pinning did not change behavior in a way that required any changes to this repo's safety-evidence content or config — no fixes to hara/tara/fmea/etc. were needed.dco.ymlandrelease.ymldo not reference cpp-FuSa, so no changes needed there.No version tag bump for this change — CI-only, no library/behavior change, and consistent with this repo's convention (the last docs-only PR, #14, also merged without a tag; only functional/behavioral PRs get version tags here).