Bind runtime releases to protected source tags [skip ci]

2026-08-04 16:43:54 +02:00
parent 8262215fcd
commit 61463a24cb
3 changed files with 33 additions and 4 deletions
@@ -155,6 +155,12 @@ installs module WebUI tarballs only after matching them to the lock. It publishe
 the package set, package lock, and hash-locked requirements as release assets.
 The WebUI installer receives the absolute runtime-build interpreter path so its
 directory changes cannot escape the isolated release environment.
+Gitea 1.24 dispatches this workflow from a branch, but that branch is only the
+workflow implementation. The job fetches and peels the protected `v<version>`
+tag explicitly, then binds both the signed distribution source and the Gitea
+release assets to that exact commit. A post-tag workflow repair can therefore
+retry publication without relabelling the later branch commit as released
+source.
 The package-lock SHA-256 is part of the signed distribution manifest. Runtime
 finalization also requires the lock's package versions and hashes to match the
 wheel composition embedded in the images. OCI assembly remains network-free