gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-09-09 05:36:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(scanner): bind release JSON artifact provenance (#7500)

Browse Source 
Require scanner/heal release evidence JSON artifacts to repeat their measured source revision, run identity, measurement window, gate, and field identity inside the artifact payload. This keeps a refreshed outer bundle hash from accepting stale summary or profile JSON from another run.

Co-authored-by: zhi22915 <qiuzgang@gmail.com>
This commit is contained in:
houseme
2026-09-08 21:48:24 +08:00
committed by GitHub
parent 1de9b40a30
commit a950f914ca
2 changed files with 128 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/testing/ci-gates.md
+6
View File
@@ -279,6 +279,12 @@ also binds each evidence field to its own run provenance: `source_revision`,
`finished_at`, command arguments, and artifact format. The field
`source_revision` must match the bundle revision, and measured performance
duration cannot exceed the recorded run window.
When an evidence or profile artifact declares a JSON format, the checker also
opens that artifact and requires its payload to repeat the same measured
`source_revision`, `run_id`, `measurement_window_id`, gate and field identity;
profile sub-artifacts must additionally name their artifact kind. Updating only
the outer bundle hash cannot turn a stale JSON summary into current release
evidence.
The hard evidence shape remains claim-specific: mixed-version gates must name at
least two participating versions, crash/durable replay gates must include