OpenSecret PCR approval (prod) for 1cd4c683 - #919
Closed
AnthonyRonning wants to merge 1 commit into
Closed
AnthonyRonning wants to merge 1 commit into
AnthonyRonning wants to merge 1 commit into
Conversation
Source commit: 1cd4c68 PCR0: 21bef9d3f216409a31f95e602b0f1a7de349782d325d8e4e46266ae48a578a9dff8bd8e31c991487e873bb726dcbc7e0 EIF SHA-256: e05945c951ef56973a7b73b46e1d242f6cb590705dabcd31cc979ef14f6d7e57 Signed by the OpenSecret EIF release workflow run 34872034708.
Contributor
Author
|
Superseded by #920, which carries both environments so each approval check compares against its updated file. |
AnthonyRonning
deleted the
opensecret/pcr-approval-prod-1cd4c68399d3
branch
September 15, 2026 00:45
w3irdrobot
pushed a commit
to w3irdrobot/Maple
that referenced
this pull request
Sep 15, 2026
Each OpenSecret EIF release run pushed its own opensecret/pcr-approval-<env>-<commit> branch, so when one commit changed both measurement sets the two single-environment pull requests each failed the other environment's approval comparison (MaplePrivacyLabs#918 and MaplePrivacyLabs#919), and the approvals had to be combined by hand (MaplePrivacyLabs#920). The publisher now targets opensecret/pcr-approval-<commit>: if the branch already exists it must descend from the source commit and change only approval files, the run refuses to repeat an environment that is already on it, and its commit is rebased onto the branch tip. A push rejected by the other environment's concurrent run is refetched, replayed and retried up to five times. Fixtures cover the sequential second environment, the repeated environment refusal, and a lost push race driven through a git shim; the runbook describes the shared branch. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signed prod approval produced by the reviewer-gated
OpenSecret EIF releaserun https://github.com/MaplePrivacyLabs/Maple/actions/runs/34872034708 from master1cd4c68399d3(health-check liveness #913, DeepSeek V4 Flash retirement #915).New PCR0:
21bef9d3f216409a31f95e602b0f1a7de349782d325d8e4e46266ae48a578a9dff8bd8e31c991487e873bb726dcbc7e0Only the two approval files change. The approval checks rebuild and compare on this PR; after merging, the four files are mirrored to the legacy repository before deployment.
🤖 Generated with Claude Code