Repository navigation
fix(build): verify artifact provenance and expose buildSha on health - #10444
Merged
Merged
Conversation
The packaged artifact stamped dist/BUILD_SHA but nothing checked that the SHA belonged to the release line, so a tarball built from a feature branch installed and served traffic indistinguishably from a release build. That is how the internal gateway ended up running a build that predated #10373 and answered every request with 502 'Executor result must contain a Response' — and the only way to identify it was SSH plus grepping the compiled chunks. - scripts/build/buildProvenance.ts classifies a build SHA against the release ref (pure functions; the git ancestry probe is injected). A missing SHA fails even with the canary override: an unidentifiable artifact cannot be vouched for. - validate-pack-artifact runs the check on real packs (skipped under --policy-only, which runs without a build). OMNIROUTE_ALLOW_CANARY_BUILD=1 records a deliberate off-release-line build instead of failing it. - /api/monitoring/health exposes system.buildSha, so what is deployed is auditable over HTTP. Absent when unknown, never fabricated. Closes #10427
It was added for tests that ended up not needing it, so it landed as a dead export and tripped the dead-code ratchet (416 vs baseline 415).
tkgo11
pushed a commit
to tkgo11/OmniRoute
that referenced
this pull request
Sep 23, 2026
…heaper-inference#10444) The packaged artifact stamped dist/BUILD_SHA but nothing verified the SHA belonged to the release line, so a tarball built from a feature branch installed and served traffic indistinguishably from a release build. That is how the internal gateway ended up running a build that predated cheaper-inference#10373 and answered every request with 502 'Executor result must contain a Response' — identifying it required SSH plus grepping the compiled chunks. scripts/build/buildProvenance.ts classifies a build SHA against the release ref (pure functions, injected git probe). A missing SHA fails even with the canary override: an unidentifiable artifact cannot be vouched for. validate-pack-artifact enforces it on real packs (skipped under --policy-only, which runs without a build); OMNIROUTE_ALLOW_CANARY_BUILD=1 records a deliberate off-release-line build instead of failing it. /api/monitoring/health now exposes system.buildSha — absent when unknown, never fabricated. Closes cheaper-inference#10427
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…heaper-inference#10444) The packaged artifact stamped dist/BUILD_SHA but nothing verified the SHA belonged to the release line, so a tarball built from a feature branch installed and served traffic indistinguishably from a release build. That is how the internal gateway ended up running a build that predated cheaper-inference#10373 and answered every request with 502 'Executor result must contain a Response' — identifying it required SSH plus grepping the compiled chunks. scripts/build/buildProvenance.ts classifies a build SHA against the release ref (pure functions, injected git probe). A missing SHA fails even with the canary override: an unidentifiable artifact cannot be vouched for. validate-pack-artifact enforces it on real packs (skipped under --policy-only, which runs without a build); OMNIROUTE_ALLOW_CANARY_BUILD=1 records a deliberate off-release-line build instead of failing it. /api/monitoring/health now exposes system.buildSha — absent when unknown, never fabricated. Closes cheaper-inference#10427
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #10427.
Why
The packaged artifact has always stamped
dist/BUILD_SHA, but nothing verified the SHA belonged to the release line. A tarball built from any feature branch installs and serves traffic indistinguishably from a release build.That gap took down the internal gateway on 2026-08-14: the installed package carried
BUILD_SHA = 178febc50f— a commit onfix/9603-qwen-token-plan-quotathat predated #10373 — so it shipped the nominalinstanceof Responseguard from #10256 and answered every request with502 … Executor result must contain a Response, across unrelated providers. Identifying it required SSH plus grepping the compiled Next chunks, because nothing exposed the running build.What changed
scripts/build/buildProvenance.ts— pure classification of a build SHA against the release ref, with the git ancestry probe injected so the policy is unit-testable without a fixture repo. A missing SHA fails even with the canary override: "canary" is a statement about a known commit, and an unidentifiable artifact can never be vouched for. Any git failure (shallow clone, unknown ref) resolves to "not provable", which is the safe answer for a gate whose purpose is refusing unverifiable artifacts.validate-pack-artifactruns the check on real packs. It is skipped under--policy-only, which deliberately runs without a build and therefore has nodist/BUILD_SHAto inspect.OMNIROUTE_ALLOW_CANARY_BUILD=1records a deliberate off-release-line build instead of failing it — the intent gets logged rather than lost./api/monitoring/healthnow returnssystem.buildSha. Absent when unknown (dev runs), never a fabricated value.Validation
pack-artifact-policy,pack-artifact-entrypoint-closures,mcp-published-files-closure-3578,observability-payloads,validate-release-green.validate-pack-artifact --policy-onlystill passes unchanged.typecheck:core,check:cycles,check:docs-all, andcheck-env-doc-syncclean; the three new env vars are documented in.env.exampleanddocs/reference/ENVIRONMENT.md.@/lib/localDbbarrel import, line 2) is pre-existing and byte-identical on the base.