Nix Forge CI v2.10.0¶
Changelog¶
- Admit same-repository Dependabot action updates after parsing complete immutable workflow blobs and proving that only existing SHA pins and version comments changed. Runtime code, permissions, aliases, new workflows, and renamed files retain deliberate admission.
- Add bounded recovery for Scorecard runs that fail on confirmed GitHub API 502, 503, or 504 responses. Only the current default-branch revision qualifies.
- Run CodeQL queries on merge-queue commits without uploading SARIF to queue refs that may disappear. PR and default-branch scanning still publish results.
- Resolve release signer digests from the actual pinned builder. Reject stale separately declared signer digests and source tags outside reviewed main history.
Existing workflow inputs and outputs remain compatible. Update general shared CI
references together with scripts/sync-release.py --release v2.10.0. Repository
checks and SLSA builders retain their separately reviewed pins. Call
retry-scorecard.yml from a metadata-only workflow_run wrapper with narrowly
scoped actions-write and contents-read permissions. Source publishers may use
actions/release-builder-sha after checking out the reviewed tagged source.
The queue action uses a pinned Python setup action and hash-verified PyYAML 6.0.3 Linux wheels. It never checks out or executes PR code. Regression cases cover action-node contexts, runtime and environment-value rejection, immutable blob identity, retry eligibility and exhaustion, signer selection, and tag ancestry. Required PR and merge-queue checks validate the candidate before tagging; consumer PRs validate immutable pins before rollout.
Publication runs through nix-forge/ci/.github/workflows/release.yml, with a source
archive, checksum, manifest, and portable Sigstore provenance from the reviewed
builder. The publisher verifies all subjects and the exact signer before publishing.
The v2.9.0 pin remains available for rollback. No support end date is scheduled
for compatible v2.x consumers.