ci(integrity): recompute-and-publish, honest attribution scope (Draft) - #95
Draft
Waschtl904 wants to merge 3 commits into
Draft
ci(integrity): recompute-and-publish, honest attribution scope (Draft)#95Waschtl904 wants to merge 3 commits into
Waschtl904 wants to merge 3 commits into
Conversation
- Rebase-and-retry up to three times on non-fast-forward push - Add concurrency group 'integrity-main' (no cancel-in-progress) so workflow_dispatch and push runs serialize on main - On persistent conflict, exit gracefully: the sibling run has authoritative INTEGRITY.md
Leitfaden für ReviewerDer Workflow serialisiert jetzt Integritätsläufe und verwendet eine Push-Logik mit Rebase und erneuten Versuchen. Wenn ein paralleler Lauf die maßgebliche Aktualisierung von INTEGRITY.md bereits veröffentlicht hat, wird der Vorgang erfolgreich abgeschlossen. Die mathematische Inhaltsgenerierung bleibt unverändert. Sequenzdiagramm für die tolerante Veröffentlichung von Integritätsaktualisierungen bei parallelen LäufensequenceDiagram
participant Workflow
participant Origin
Workflow->>Origin: git push
alt push succeeds
Origin-->>Workflow: accepted
Workflow-->>Workflow: exit 0
else push rejected
Workflow->>Origin: git fetch origin main
Workflow->>Workflow: git rebase origin/main
alt rebase succeeds
Workflow->>Origin: git push
Origin-->>Workflow: accepted or rejected
else rebase conflict
Workflow->>Workflow: git rebase --abort
Workflow-->>Workflow: exit 0
end
end
Änderungen auf Dateiebene
Tipps und BefehleInteraktion mit Sourcery
Deine Erfahrung anpassenRufe dein Dashboard auf, um:
Hilfe erhalten
Original review guide in EnglishReviewer's GuideThe workflow now serializes integrity runs and uses rebase-and-retry push logic, gracefully succeeding when a concurrent run has already published the authoritative INTEGRITY.md update; the mathematical/content generation is unchanged. Sequence diagram for race-tolerant integrity publishingsequenceDiagram
participant Workflow
participant Origin
Workflow->>Origin: git push
alt push succeeds
Origin-->>Workflow: accepted
Workflow-->>Workflow: exit 0
else push rejected
Workflow->>Origin: git fetch origin main
Workflow->>Workflow: git rebase origin/main
alt rebase succeeds
Workflow->>Origin: git push
Origin-->>Workflow: accepted or rejected
else rebase conflict
Workflow->>Workflow: git rebase --abort
Workflow-->>Workflow: exit 0
end
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
…ution language - Workflow rewrite: always fetch fresh origin/main, rebuild manifest from that snapshot, self-verify with scripts/verify_integrity.sh, publish fast-forward only. Never rebase a pre-built manifest. - On persistent push rejection: fetch remote and verify remote manifest against remote sources; fail loud if it does not match. - Add scripts/build_integrity.sh (deterministic, no timestamp) and scripts/verify_integrity.sh (byte-exact check). - Add workflow file and scripts to paths filter so this PR itself triggers the workflow. - .canary: acknowledge that a token hit is an investigative lead, not a training-data proof. - ATTRIBUTION.md: scope CC-BY-4.0 attribution claim to expression covered by copyright; explicit statement that markers are not cryptographic signatures.
…SSING branch - build_integrity.sh: pre-flight check exits 1 on any missing/unreadable required file; MISSING row removed. - workflow: 'git add -- INTEGRITY.md' before 'git diff --cached --quiet' so a newly created (untracked) manifest is actually published; add INTEGRITY.md itself to paths filter so manifest-only edits trigger. - workflow comment: correct scope of cancel-in-progress: false. - ATTRIBUTION.md: HTML-/LaTeX-Kommentar-Marker + cross-ref to scope section. - INTEGRITY.md: regenerated from the full PR snapshot; .canary and ATTRIBUTION.md hash rows now match the actual head bytes.
Waschtl904
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recompute-and-publish. Kein Rebase. Jeder Versuch: frischer origin/main via fetch, INTEGRITY.md aus genau diesem Snapshot per scripts/build_integrity.sh neu berechnen, byte-genaue Selbstpruefung per scripts/verify_integrity.sh, dann ausschliesslich Fast-forward-Push. Bei Ablehnung: lokalen Commit verwerfen und neu starten. Drei Versuche.
Nach ausgeschoepften Versuchen: Remote-Manifest unabhaengig gegen Remote-Quellen pruefen. Nur bei OK exit 0, sonst exit 1.
Zusaetzlich in diesem Aufsatz-Commit ebaa488:
Vorgaengerstand 69dc670 bleibt als Pruefanker.