Skip to content

docs: finalize verified main merge audit #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Adrian463588 merged 1 commit into from
Oct 12, 2026
Merged

docs: finalize verified main merge audit #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions MAIN_MERGE_AUDIT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,9 @@
- [x] CI uses full action commit SHAs, `contents: read`, no persisted checkout credentials, bounded jobs, Gitleaks binary SHA-256 and Gradle distribution SHA-256.
- [x] Publication policy rejects current tracked forbidden files and every incoming commit's added/modified/renamed paths, including deleted-later bundles. Five policy tests passed.
- [x] Staged tracked-tree Gitleaks scan passed (no findings); publication policy passed for **201 paths / 7 incoming commits** before the integration commit. `git diff --cached --check` passed after normalizing the two inherited theme XML line endings; resource values are unchanged.
- [ ] Exact prepared-head and PR CI.
- [ ] PR creation, non-squash merge and resulting main/post-merge CI verification.
- [x] Exact prepared head `f3e84f64c61e492c2d7f2e1db8a99403368c2946`: [push CI](https://github.com/Adrian463588/HeartRateMonitor/actions/runs/38294072262) and [PR CI](https://github.com/Adrian463588/HeartRateMonitor/actions/runs/38294078210) both passed publication-safety and phone-and-shared.
- [x] [PR #1](https://github.com/Adrian463588/HeartRateMonitor/pull/1) merged using a two-parent merge commit; [post-merge main CI](https://github.com/Adrian463588/HeartRateMonitor/actions/runs/38294595356) passed.
- [x] Main branch protection requires both GitHub Actions checks, up-to-date branches and resolved conversations, including for admins; force-push/deletion are disabled and merge commits remain allowed. No admin bypass or forged/self-approval was used.

No AAR exists in either initial source tree. Both histories already contain
Polar AAR `3526ed159b8c210662b0cc8bd904167f772eda3c` at historical
Expand All @@ -46,4 +47,16 @@ No new Samsung/Polar AAR or recording may enter this PR.

## Delivery receipt

Pending exact candidate commit, PR and resulting main merge SHA/parents/checks.
Primary [PR #1](https://github.com/Adrian463588/HeartRateMonitor/pull/1) is **MERGED**. Main merge commit: `c63f1e2188385c8609d991d06da1cf2ed561aca0`.

Parents:

1. Original main `db5d56f60dc4ee71be4084623e643af872de984f`.
2. Prepared Fix-issue `f3e84f64c61e492c2d7f2e1db8a99403368c2946`.

- Both initial branch tips remain ancestors of main. Main and the merged Fix-issue tree were identical; **no squash/rebase** or force-push/tag rewrite occurred. Both branches remain available.
- Post-merge publication policy passed for **201 tracked paths / 11 incoming commits** relative to original main. Incoming object range contained **0 AAR/APK/AAB/CSV/signing-key paths**.
- Full-history secret scanning includes first-parent merge diffs. Candidate scan before publication: **121 commits / 1.94 MB, no findings**; current staged-tree scan also found none. CI repeated scanning on exact PR head and resulting main.
- [Main CI 38294595356](https://github.com/Adrian463588/HeartRateMonitor/actions/runs/38294595356) passed on `c63f1e2188385c8609d991d06da1cf2ed561aca0`. Future changes must satisfy the protected checks.
- Release tags remain `debug-2026-10-01=db5d56f`, `v1.3.0=563d6c1`, `v1.3.1=97a3469`; existing APK assets were not replaced.
- This receipt is a documentation-only follow-up to the verified merge; application code/gate configuration are unchanged.
Loading