Repository navigation
fix: keep generated release outputs out of VCS dirtiness - #1078
Merged
Merged
Conversation
Ignore the root dist directory after the extension allow-list rules. The snapshot builds a Windows server executable before wfctl, and the later !*.* rule otherwise makes that generated binary appear untracked. Keep Go VCS stamping enabled and preserve all generated artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snapshot builds the Windows server executable before the Linux CLI. The root
.gitignorehas an early*.exerule followed by!*.*, so generated release files become untracked and the CLI recordsvcs.modified=true.Add root
/dist/after the allow-list rules. This preserves generated files and Go VCS stamping, limits the change to the generated release directory, and leaves all source/build commands, workflows, authority maps, dependencies and security settings unchanged. Exact baseb8385b7914cd8e94fb5657ff8c63a999bbba365a, headc2fc267a9bcd1f2431cda8d387b621327bc46af7, tree8c08d644d8441bca6c644c0ca0a14c3290ce4ee3; only.gitignorechanges and the other 3,551 tracked blobs/modes match.Validation: a Git fixture reproduces the original generated-output dirtiness, verifies clean status with all 12 representative release outputs under the candidate rule, and still detects tracked source changes and new Go source. Reverting the rule reproduces the defect; restoring it passes. Both independent source reviews have no blocking findings, and the configured commit hook passes. This PR's own CI and actual merged-main snapshot/release artifact metadata remain required. Known vulnerability reports and incomplete security coverage remain separately recorded; advisory performance is not an acceptance veto. No deployment or credential issuance.