Adopt shared version-pinned CI and release images

Đang mở
  • Có gì không ổn?
#339 0 bình luận 0 reaction 1 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@kikashy đang làm issue này rồi.

Từ ngày 28/10/2026.

Đánh giá

Issue này chưa được đánh giá.

Mô tả

Shared dependency

Implement the repository adoption of Devkit #59, which owns the shared versioned CI/release image policy, infrastructure choice and image-update lifecycle. Target: v0.39.0.

Problem

Agent v0.11.0 exposed a mismatch between rolling GitHub-hosted runner images and a gate requiring identical CI/release image identities. An explicit OS label alone does not pin a complete machine image. Adopt the shared solution rather than introducing a separate repository-specific exception or policy.

Repository scope

Cover Runtime CI and release/build workflows and all supported release platforms. Preserve certification, full mutation coverage, signed release/provenance and consumer acceptance gates. Coordinate with the existing Runtime release lane.

Acceptance criteria

  • Inventory the repository's CI, build, release and deployment jobs and supported platforms; identify the evidence-producing and evidence-consuming jobs that must share a pinned image version.
  • Adopt the reviewed Devkit policy and versioned manifest/configuration at an immutable revision. Use the approved version-pinned runner image route; preserve necessary platform variants.
  • Pin relevant toolchains/actions and record actual image, OS/architecture and tool identities. Ensure evidence admission matches those guarantees; an OS label or container digest alone must not be described as a pinned full VM image.
  • Integrate the shared reviewed image-update, security-patch, promotion, rollback and retirement process. Avoid independent copied policy or indefinitely frozen images.
  • Preserve trusted-runner boundaries: untrusted PR execution must not be able to modify shared images or gain publication credentials.
  • Where evidence is reused, verify matching allowed identities and refusal for missing/unexpected identities, changed inputs or incomplete evidence, with meaningful safeguard-removal tests. Do not add an older-green fallback or silently weaken current gates.
  • Run focused checks for the changed contracts, then required CI on the stable integrated candidate and independent review. Preserve existing full release validation and artifact/provenance checks; no full-suite/CI cycle merely per subtask.
  • Update repository contributor/release documentation and link adoption evidence back to Devkit #59.

Coordination

This issue records future work assigned by the maintainer. Coordinate implementation with the repository's active session; issue creation does not change running workflows or authorize unreviewed infrastructure provisioning. The Agent v0.11.0 temporary exception remains limited to its approved scope and expiry.

References: GitHub image lifecycle, version-pinned custom images.

Ngôn ngữ chính
Go
Star
2
Fork
6
Merge trung bình
2 giờ 22 phút
Pull request đã merge (30 ngày)
89

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của Judgment-Pack/judgment-pack-runtime

Tất cả issue của Judgment-Pack/judgment-pack-runtime

Issue tương tự

Thêm issue về Go

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.