From e64c17db973e7aa8e63cb97cd81cf34942fb8020 Mon Sep 17 00:00:00 2001 From: adrian463588 Date: Tue, 13 Oct 2026 02:09:24 +0700 Subject: [PATCH] docs: complete main merge and DevSecOps audit receipt Record PR #1 merge parents, exact passing CI runs, main branch protection and current/incoming artifact and redacted secret-scan results. Preserve the explicit pre-existing Polar AAR and unavailable hardware boundaries. Co-Authored-By: Codex (GPT-6) --- MAIN_MERGE_AUDIT.md | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/MAIN_MERGE_AUDIT.md b/MAIN_MERGE_AUDIT.md index 8c7771c..f08c57d 100644 --- a/MAIN_MERGE_AUDIT.md +++ b/MAIN_MERGE_AUDIT.md @@ -26,8 +26,9 @@ - [x] CI uses full action commit SHAs, `contents: read`, no persisted checkout credentials, bounded jobs, Gitleaks binary SHA-256 and Gradle distribution SHA-256. - [x] Publication policy rejects current tracked forbidden files and every incoming commit's added/modified/renamed paths, including deleted-later bundles. Five policy tests passed. - [x] Staged tracked-tree Gitleaks scan passed (no findings); publication policy passed for **201 paths / 7 incoming commits** before the integration commit. `git diff --cached --check` passed after normalizing the two inherited theme XML line endings; resource values are unchanged. -- [ ] Exact prepared-head and PR CI. -- [ ] PR creation, non-squash merge and resulting main/post-merge CI verification. +- [x] Exact prepared head `f3e84f64c61e492c2d7f2e1db8a99403368c2946`: [push CI](https://github.com/Adrian463588/HeartRateMonitor/actions/runs/38294072262) and [PR CI](https://github.com/Adrian463588/HeartRateMonitor/actions/runs/38294078210) both passed publication-safety and phone-and-shared. +- [x] [PR #1](https://github.com/Adrian463588/HeartRateMonitor/pull/1) merged using a two-parent merge commit; [post-merge main CI](https://github.com/Adrian463588/HeartRateMonitor/actions/runs/38294595356) passed. +- [x] Main branch protection requires both GitHub Actions checks, up-to-date branches and resolved conversations, including for admins; force-push/deletion are disabled and merge commits remain allowed. No admin bypass or forged/self-approval was used. No AAR exists in either initial source tree. Both histories already contain Polar AAR `3526ed159b8c210662b0cc8bd904167f772eda3c` at historical @@ -46,4 +47,16 @@ No new Samsung/Polar AAR or recording may enter this PR. ## Delivery receipt -Pending exact candidate commit, PR and resulting main merge SHA/parents/checks. +Primary [PR #1](https://github.com/Adrian463588/HeartRateMonitor/pull/1) is **MERGED**. Main merge commit: `c63f1e2188385c8609d991d06da1cf2ed561aca0`. + +Parents: + +1. Original main `db5d56f60dc4ee71be4084623e643af872de984f`. +2. Prepared Fix-issue `f3e84f64c61e492c2d7f2e1db8a99403368c2946`. + +- Both initial branch tips remain ancestors of main. Main and the merged Fix-issue tree were identical; **no squash/rebase** or force-push/tag rewrite occurred. Both branches remain available. +- Post-merge publication policy passed for **201 tracked paths / 11 incoming commits** relative to original main. Incoming object range contained **0 AAR/APK/AAB/CSV/signing-key paths**. +- Full-history secret scanning includes first-parent merge diffs. Candidate scan before publication: **121 commits / 1.94 MB, no findings**; current staged-tree scan also found none. CI repeated scanning on exact PR head and resulting main. +- [Main CI 38294595356](https://github.com/Adrian463588/HeartRateMonitor/actions/runs/38294595356) passed on `c63f1e2188385c8609d991d06da1cf2ed561aca0`. Future changes must satisfy the protected checks. +- Release tags remain `debug-2026-10-01=db5d56f`, `v1.3.0=563d6c1`, `v1.3.1=97a3469`; existing APK assets were not replaced. +- This receipt is a documentation-only follow-up to the verified merge; application code/gate configuration are unchanged.