ci: verify dependency license evidence - #36
Merged
Conversation
AlexStocks
force-pushed
the
codex/wp0-portable-sdk
branch
from
August 28, 2026 10:57
297fb67 to
eac7fbd
Compare
AlexStocks
force-pushed
the
codex/wp0-license-dependencies
branch
from
August 29, 2026 05:15
ec76fde to
10e9c86
Compare
Rebuild the stale stacked change on current main, expose the existing release license collector as a CI entry point, and keep the evidence bounded and deterministic. Use Go 1.27 encoding/json/v2 for the new JSON surface and provision SQLite headers explicitly in the independent job. Constraint: Keep the change limited to release tooling, CI topology, documentation, regression coverage, and the required learned rule. Rejected: Retaining the rewritten stacked base, duplicating the license scanner, or relying on preinstalled SQLite headers. Confidence: High. Scope-risk: No public API, protocol, persistence, generated contract, or runtime behavior changes. Tested: Targeted red-green release tests, go vet ./tools/release, git diff --check, and two identical Linux real-binary license manifests with 95 Go modules and 1 native dependency. Not-tested: Full Windows release tests because Windows does not preserve Unix executable mode and the standard CGO build is not a supported Windows binary contract. Co-authored-by: OmX <omx@oh-my-codex.dev>
GitHub did not create check suites when the branch force-update and base retarget occurred together. Add a tree-identical synchronization commit so every pull-request workflow evaluates the rebuilt branch instead of leaving a zero-check evidence gap. Constraint: Keep the source tree identical to 10e9c86. Rejected: Treating zero exact-Head runs as green or rerunning workflows bound to the obsolete ec76fde Head. Confidence: High. Scope-risk: Commit metadata only; no file content changes. Tested: The parent tree passed clean-LF Linux release, full Go, generated, lint, vet, license, and actionlint gates. Not-tested: Exact-Head GitHub Actions are pending this synchronization event. Co-authored-by: OmX <omx@oh-my-codex.dev>
Name the directory-creation and manifest-write failures by operation so the pinned govet shadow policy no longer treats them as redeclarations of the function's retained error value. Record the reusable prevention rule in the repository engineering contract. Constraint: Change only the two shadowing declarations and the required learned rule. Rejected: Disabling govet shadow, adding a lint waiver, or broad refactoring of release error handling. Confidence: High. Scope-risk: Error names only; observable success and failure behavior is unchanged. Tested: Reproduced two govet shadow diagnostics, then passed the targeted release inventory test, go vet ./tools/release, and git diff --check. Not-tested: Exact-Head GitHub Actions require the updated commit. Co-authored-by: OmX <omx@oh-my-codex.dev>
AlexStocks
force-pushed
the
codex/wp0-license-dependencies
branch
from
August 29, 2026 06:00
0a56609 to
2525fb2
Compare
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release licenses, which reads a built binary's actual Go build info and verifies top-level license/notice evidence for every linked moduleencoding/json/v2API and report module/native dependency counts without local pathsmake license-dependenciestarget for the standard binarylicense-dependenciesCI job with explicit SQLite development headers and a 14-day evidence artifactRationale
WP0-C in #3 requires dependency-license evidence before release packaging. The repository already uses
collectLicensesduring release archive creation; this change exposes that implementation for ordinary pull requests instead of adding a second license scanner.The portable SDK prerequisite landed on
mainthrough #35. This branch was rebuilt directly on the currentmainHead so the obsolete #34 stack and its conflict are no longer part of the pull request.Behavior, API, and compatibility
Validation
go test -count=1 ./tools/releasego test -count=1 ./...go vet ./tools/releasemake license-dependenciestwice in LF Linux; both manifests were byte-identical with 95 Go modules and 1 native dependencymake check-generatedmake checkmake lint(0 issues)make license-checkgo run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12git diff --checkExact PR Head validated locally:
2525fb25ac12dd1c9a931333d7c180a526ddbf7f.AI usage
Implemented and reviewed with Codex assistance. The new test was checked against test-guard, and the final commit was revalidated in a clean LF Linux clone.