Repository navigation
Conversation
javaDevJT
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Receipt publication rejected the shell command echoed by GitHub Actions before reaching the actual digest output. Parse only canonical output with valid GitHub timestamp framing, ignoring the command echo inside the runner's Run group. Keep exact source SHA, run, attempt, digest and duplicate-marker checks.
The shared helper passed 12 focused tests, including realistic command echoes, malformed output, invalid timestamps, wrong identity and duplicate markers. It also extracted the expected digest from the exact successful RouteListToTesla publisher job log. The copied helper matches the independently reviewed Quarterback implementation; each repository's existing private CI remains required.
Verified same-repository Dependabot pull requests can now run read-only validation, using the exact actor, author login and numeric bot identity. Fork and identity mismatch guards remain enforced. Image publication guards are unchanged; Dependabot-authored PRs skip Docker Hub secret login. Existing current-run artifact cleanup continues from the trusted default-branch implementation.
The focused seven-repository guard fixture passes all five tests. Independent review of the checksum-verified deployed private-runner source confirms that each runner's BuildKit client key reaches only that job's isolated builder, with no published builder port or host Docker socket. Source publication and deployment still require successful private CI and valid build receipts.