trex/trex-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ops): address provenance gate review findings

Browse Source 
Co-authored-by: genichin <4282227+genichin@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-09-13 16:12:55 +09:00
committed by Hermes Agent
co-authored by genichin
parent 8d9d627b1c
commit 619feff5f4
3 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/release_provenance_gate.py
+14 -3
View File
@@ -72,7 +72,16 @@ def main(argv: list[str] | None = None) -> int:
output_dir.mkdir(parents=True, exist_ok=True)
output_path = _record_path(output_dir, instance=args.instance, command_class=args.command_class)
if report["checkout"]["dirty_paths"] and not args.allow_dirty:
dirty_checkout = bool(report["checkout"]["dirty_paths"])
runtime_ok = all(
item.get("matches_expected_revision", False) for item in report["runtime_file_verification"]
)
oci_ok = bool(report["artifact_identity"]["oci_revision_matches_head"])
allow_dirty_passed = bool(args.allow_dirty and dirty_checkout and runtime_ok and oci_ok)
report["gate"]["allow_dirty"] = bool(args.allow_dirty)
report["gate"]["allow_dirty_passed"] = allow_dirty_passed
if dirty_checkout and not args.allow_dirty:
report["dirty_checkout_isolation"] = isolate_dirty_checkout_files(
checkout_dir=args.checkout_dir,
isolate_dir=args.isolate_dir,
@@ -80,9 +89,11 @@ def main(argv: list[str] | None = None) -> int:
output_path.write_text(json.dumps(report, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
print(str(output_path))
if report["checkout"]["dirty_paths"] and not args.allow_dirty:
if dirty_checkout and not args.allow_dirty:
return 2
return 0 if report["gate"]["passed"] else 1
if report["gate"]["passed"] or allow_dirty_passed:
return 0
return 1
if __name__ == "__main__":