Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepare a verify-first publisher for the already merged beta.5 Node package at
8b78387df4c33140a52c19c6de6fcc8d4aa7595c.The workflow downloads all five original, digest-pinned successful CI artifacts from run 39263641585, preserves original compilation provenance and checks all native build/admission source inputs against final main. It runs the native/type/worker gates, records the exact package bytes and gitHead, authenticates the existing npm credential, and publishes only after explicit beta.5 confirmation. Existing npm versions are never overwritten. The npm beta tag preserves current latest.
Run
verifybeforepublish. This isolated automation branch keeps the package source frozen at WDK's reviewed exact main pin; merging the automation during beta.5 publication would change that pin. The branch itself is the honest SLSA assembly builder. No native runtime code or original binary bytes change.Publication complete
Beta.5 publication and independent public source, archive, SLSA and cryptographic checks are complete. Closing this temporary automation PR without merging preserves the frozen native main source identities already pinned by WDK. The publisher branch and commit remain available for provenance verification. No branch or artifact is deleted. The only remaining merge needed for the WDK release is WDK #49, which fixes the separately discovered Bare dependency-resolution compatibility issue.