GovOPlaN/govoplan
1
0
Fork 0
Code Issues 10 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Block mismatched selective WebUI releases
Some checks failed
Dependency Audit / dependency-audit (push) Failing after 15s
Details
Security Audit / security-audit (push) Failing after 13s
Details

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-22 10:37:19 +02:00
parent 568ea6059a
commit 5447299289
7 changed files with 429 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/RELEASE_CONSOLE.md
View File

@@ -193,6 +193,12 @@ forcing every repository to the same tag, but channel publication must preserve
the unchanged package versions, validate interface compatibility, sign the
updated catalog, and keep the published keyring healthy.
When a selected module exposes a WebUI package, its requested version must also
match Core's `webui/package.release.json` input and the resolved
`package-lock.release.json` entry. The source-tag preflight, selective plan, and
catalog-candidate writer all enforce this composition boundary. Pins for modules
that are not part of the selective release remain unchanged.
Release integration also enforces repository and composition version alignment
and generates a CycloneDX SBOM from the resolved Python environment and the
release WebUI lockfile. Catalog publication should attach that immutable SBOM