Repository navigation
ci: adopt frozen Go27 policy bridge - #1025
Merged
Merged
Conversation
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopt only the five immutable bridge files authorized by #1024:
The workflow selects Go 1.27.1 for both trusted and authorized-candidate
analysis. The isolated module retains its Go 1.26.5 minimum. Authority manifests,
wrapper, original mutation harness, module files, and fixtures are unchanged.
The current adoption passes the trusted-base scan without fallback. Later
policy adoption can execute candidate analysis only after the already-trusted
guard authorizes the exact previously staged inventory and executable pins.
Verification
stage/adopt/promote chain, no-history execution, skew, and rejection cases.
installed by this PR. Input bytes, modes, status, and index are preserved.
EVENT_NAME: unbound variable. This is the explicitly approved temporarybootstrap exception, not a passing test. Its separately authorized correction
must pass actual hosted CI before that exception expires.
extracted, 22 coverage records, and the same 61 pinned baseline findings.
Exactly two pre-existing conformance fixture metadata errors remain; the
other 12 modules have no failure diagnostics. Scanner and reporter both exit
while its default strict mode still rejects these errors (exit 1). This is
native evidence only, not a green scan or a replacement for hosted checks.
Runtime Launch
The actual trusted wrapper scans the candidate repository successfully on both
OSes. The guard tests execute real trusted-wrapper/guard/candidate-scanner
crossings for authorized synthetic lifecycle transitions and reject unauthorized
transitions without a candidate-execution marker. Synthetic future transitions
are conformance coverage, not a claim that the later policy has been adopted.
The remaining CI compiler wave and harness correction are intentionally not
part of this exact-file adoption. No timeout, scanner setting, ignore, secret,
OIDC, credential, or runner policy is changed.
Doc-reconciliation: clean