docs: correct two claims that no longer match reality - #33
Merged
Conversation
RELEASING.md's trusted-publishing table still recorded the policy Repository as lakespeak. The repository was renamed to LakeSpeak.NET, and the live policy was updated to match -- but that table is explicitly framed as a record of what is configured, so a stale row there is worse than no row: it is the thing someone would rebuild the policy from after it broke. The provenance action was pinned with a comment claiming v2. The pinned commit 0f67c3f is actually tagged v4.1.1; the real v2 is a different commit entirely. The pin itself is fine and has produced valid attestations in two rehearsal runs, so the SHA is kept and the comment corrected rather than re-pinning to an older major. Audited every other pinned action while here: all thirteen version comments match the tags their commits actually carry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both found by an independent release-readiness reviewer, both verified at source before acting.
RELEASING.mdmisdocumented the live trusted-publishing policyThe table still recorded Repository:
lakespeak. The repo was renamed toLakeSpeak.NETand the live policy on nuget.org was updated to match — but that table is explicitly framed as a record of what is configured, so a stale row is worse than no row: it is precisely what someone would rebuild the policy from after it broke.The reviewer rated this critical on the assumption the live policy was also stale, which would have failed the OIDC exchange. It isn't — the policy was updated. So this is a real documentation defect, not a release blocker.
The provenance action pin claimed the wrong version
actions/attest-build-provenance@0f67c3f…carried# v2. That commit is actually tagged v4.1.1; the realv2is a different commit (e8998f9…).The pin works — two rehearsal runs produced valid SLSA attestations naming both packages — so the SHA is kept and the comment corrected, rather than re-pinning to an older major just to make a comment true.
Swept the rest
Audited all 13 pinned actions against the GitHub tags API. Every other version comment matches the tag its commit actually carries, CodeQL included (its four entries share one SHA correctly tagged
v4.37.3).No functional change. The pending release run is unaffected — it executes the workflow from the tagged commit, not from
main.