OpenSecret PCR approval (dev) for 1cd4c683 - #918
Closed
AnthonyRonning wants to merge 1 commit into
Closed
AnthonyRonning wants to merge 1 commit into
AnthonyRonning wants to merge 1 commit into
Conversation
Source commit: 1cd4c68 PCR0: 1092211c6a982fcc74da98b9dcb854d5fbb193fcfb58ac93a18c63de0542bf403863ce00083c648abdc35bfff325632d EIF SHA-256: 21420d54c94ac35d61883a6c3168e48b5cee0f8b4fc9d43f8ef4d40075816685 Signed by the OpenSecret EIF release workflow run 34872032464.
Contributor
Author
|
Superseded by #920, which carries both environments so each approval check compares against its updated file. |
w3irdrobot
pushed a commit
to w3irdrobot/Maple
that referenced
this pull request
Sep 15, 2026
Each OpenSecret EIF release run pushed its own opensecret/pcr-approval-<env>-<commit> branch, so when one commit changed both measurement sets the two single-environment pull requests each failed the other environment's approval comparison (MaplePrivacyLabs#918 and MaplePrivacyLabs#919), and the approvals had to be combined by hand (MaplePrivacyLabs#920). The publisher now targets opensecret/pcr-approval-<commit>: if the branch already exists it must descend from the source commit and change only approval files, the run refuses to repeat an environment that is already on it, and its commit is rebased onto the branch tip. A push rejected by the other environment's concurrent run is refetched, replayed and retried up to five times. Fixtures cover the sequential second environment, the repeated environment refusal, and a lost push race driven through a git shim; the runbook describes the shared branch. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signed dev approval produced by the reviewer-gated
OpenSecret EIF releaserun https://github.com/MaplePrivacyLabs/Maple/actions/runs/34872032464 from master1cd4c68399d3(health-check liveness #913, DeepSeek V4 Flash retirement #915).New PCR0:
1092211c6a982fcc74da98b9dcb854d5fbb193fcfb58ac93a18c63de0542bf403863ce00083c648abdc35bfff325632dOnly the two approval files change. The approval checks rebuild and compare on this PR; after merging, the four files are mirrored to the legacy repository before deployment.
🤖 Generated with Claude Code