Skip to content

fix(ci): stamp baseline target version and draft flag at publish time - #550

Merged
eddie-knight merged 5 commits into
ossf:mainfrom
eddie-knight:fix/published-artifact-metadata
Aug 31, 2026
Merged

fix(ci): stamp baseline target version and draft flag at publish time#550
eddie-knight merged 5 commits into
ossf:mainfrom
eddie-knight:fix/published-artifact-metadata

Conversation

@eddie-knight

Copy link
Copy Markdown
Contributor

Published artifacts for v2026.08.28 shipped with their osps-baseline mapping-reference still reading 'draft' and metadata.draft still true, because only metadata.version was stamped at publish time. The committed YAML is correct as-is (in-repo it tracks devel), so extend the existing publish-time stamp instead of editing the documents each release:

  • pin each mapping document's osps-baseline reference to RELEASE_VERSION
  • set metadata.draft from ARTIFACT_DRAFT: false for explicitly versioned publishes (release tag or dispatch version input), true for the dev-SHA fallback; only applied where a draft flag already exists

All 15 stamped artifacts verified against the CUE schema locally.

Published artifacts for v2026.08.28 shipped with their osps-baseline
mapping-reference still reading 'draft' and metadata.draft still true,
because only metadata.version was stamped at publish time. The committed
YAML is correct as-is (in-repo it tracks devel), so extend the existing
publish-time stamp instead of editing the documents each release:

- pin each mapping document's osps-baseline reference to RELEASE_VERSION
- set metadata.draft from ARTIFACT_DRAFT: false for explicitly versioned
  publishes (release tag or dispatch version input), true for the
  dev-SHA fallback; only applied where a draft flag already exists

All 15 stamped artifacts verified against the CUE schema locally.

Signed-off-by: Eddie Knight <knight@linux.com>
A drifted osps-baseline reference id would make the version pin a silent
no-op, and `cue vet` would still pass because "draft" is a valid version
string — the same failure class that shipped v2026.08.28 unstamped. Assert
the pin took effect on each staged mapping document before grcli publishes
it; the catalog has no osps-baseline self-reference and is exempt.

Also drop the `with(select(has("draft")))` guard: all 15 artifacts carry
metadata.draft, so it only served to let a future artifact that forgot the
flag ship without one instead of getting the correct value.

Verified locally by running the publish loop verbatim with grcli stubbed:
both trigger paths stamp all 15 artifacts and pass `cue vet`, and renaming
the reference id aborts the loop before any mapping is published.

Signed-off-by: Eddie Knight <knight@linux.com>
Signed-off-by: Eddie Knight <knight@linux.com>
Signed-off-by: Eddie Knight <knight@linux.com>
@eddie-knight
eddie-knight force-pushed the fix/published-artifact-metadata branch from 247e241 to c5cac8a Compare August 31, 2026 13:06
@eddie-knight
eddie-knight marked this pull request as ready for review August 31, 2026 13:08
@eddie-knight
eddie-knight requested a review from a team August 31, 2026 13:08
Comment thread .gitignore Outdated
Signed-off-by: Eddie Knight <21176439+eddie-knight@users.noreply.github.com>
@eddie-knight
eddie-knight merged commit 91fcf4c into ossf:main Aug 31, 2026
7 checks passed
@eddie-knight
eddie-knight deleted the fix/published-artifact-metadata branch August 31, 2026 22:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants