ci: capture bounded booklet build environment #10

Merged

clawlter merged 4 commits from audit/bound-build-environment into audit/pdf-artifact-provenance

2026-07-13 01:47:25 -04:00

clawlter commented

2026-07-12 23:24:45 -04:00

Owner

Summary

define a checked-in Ubuntu 24.04 build-environment contract for CI tooling and exact apt package versions
resolve the moving checkout v6 tag to a concrete commit, record that provenance, and enforce the maintained major plus recorded snapshot with a clear intentional-update path
capture tool versions, apt versions, runner identity, font resolution, checkout provenance, and source commit as a JSON Actions artifact
fail fast on unsupported runner/tool/package/font/checkout drift while preserving diagnostics for upload
test strict-mode output persistence and document the contract, update process, and rollback path

Verification

python3 -m unittest discover -s tests -v (31 passed)
TEXLIVE_BIN=/opt/hermes-runtime/tools/texlive/2026/bin/x86_64-linux make clean build
qpdf --check build/booklet-pages.pdf
qpdf --check build/booklet-print.pdf
git fsck --full
git lfs fsck
git verify-commit HEAD
Forgejo Actions run 29: success (all 9 steps)
downloaded build-environment-provenance artifact: parseable JSON, contract_check.strict=true, no errors, Ubuntu 24.04.4, checkout snapshot matched

Review follow-up

Added regression coverage proving strict runner drift persists parseable diagnostics before returning nonzero.
Clarified scheduler selection versus the effective Ubuntu 24.04 environment in README. The checked-in workflow uses runs-on: ubuntu-latest and no container: stanza; this differs from the earlier review text claiming runs-on: docker, so the documentation follows fetched signed source HEAD rather than asserting a nonexistent stanza.

Rollback

Revert the branch commits; no booklet source, rendered PDFs, or release artifacts are changed by this PR.

## Summary - define a checked-in Ubuntu 24.04 build-environment contract for CI tooling and exact apt package versions - resolve the moving checkout v6 tag to a concrete commit, record that provenance, and enforce the maintained major plus recorded snapshot with a clear intentional-update path - capture tool versions, apt versions, runner identity, font resolution, checkout provenance, and source commit as a JSON Actions artifact - fail fast on unsupported runner/tool/package/font/checkout drift while preserving diagnostics for upload - test strict-mode output persistence and document the contract, update process, and rollback path ## Verification - `python3 -m unittest discover -s tests -v` (31 passed) - `TEXLIVE_BIN=/opt/hermes-runtime/tools/texlive/2026/bin/x86_64-linux make clean build` - `qpdf --check build/booklet-pages.pdf` - `qpdf --check build/booklet-print.pdf` - `git fsck --full` - `git lfs fsck` - `git verify-commit HEAD` - Forgejo Actions run 29: success (all 9 steps) - downloaded `build-environment-provenance` artifact: parseable JSON, `contract_check.strict=true`, no errors, Ubuntu 24.04.4, checkout snapshot matched ## Review follow-up - Added regression coverage proving strict runner drift persists parseable diagnostics before returning nonzero. - Clarified scheduler selection versus the effective Ubuntu 24.04 environment in README. The checked-in workflow uses `runs-on: ubuntu-latest` and no `container:` stanza; this differs from the earlier review text claiming `runs-on: docker`, so the documentation follows fetched signed source HEAD rather than asserting a nonexistent stanza. ## Rollback Revert the branch commits; no booklet source, rendered PDFs, or release artifacts are changed by this PR.

clawlter added 1 commit

2026-07-12 23:24:45 -04:00

ci: capture bounded booklet build environment

Booklet CI / Validate and build booklet PDFs (pull_request) Has been cancelled

Details

1342f94099