Skip to content

Preflight: commit result without a trailing newline (provenance gate failed every release since 10-08) #112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jfillman merged 1 commit into from
Oct 14, 2026
Merged

Preflight: commit result without a trailing newline (provenance gate failed every release since 10-08) #112

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion charts/glidepath-catalog/templates/tasks/stage-preflight.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,11 @@ spec:
git checkout --quiet FETCH_HEAD

echo -n "${GIT_URL}" > "$(results.url.path)"
git rev-parse FETCH_HEAD | tr -d \'\n\' > "$(results.commit.path)"
# printf, not `| tr -d`: written as tr -d \'\n\' this deleted the characters ' and n, not the newline, so
# CHAINS-GIT_COMMIT carried a trailing newline into every build's SLSA provenance and the release gate's
# Conforma policy failed every release PR since 2026-10-08 ("Material digest ... is not a git commit sha",
# "Expected source code reference was not provided"). Found live on gitops-boarding-api#41 and #45.
printf '%s' "$(git rev-parse FETCH_HEAD)" > "$(results.commit.path)"
echo "clone successful: ${GIT_URL} @ $(git rev-parse --short=12 FETCH_HEAD) (requested ${clone_revision}, depth 1, $(git ls-files | wc -l | tr -d ' ') files)"
else
echo "no source workspace bound (event-chained ${STAGE_NAME}) - nothing to clone"
Expand Down
Loading