fix(ci): package locally verified source without remote tests #8

Merged
dmg merged 1 commits from fs-build-02-package-locally-verified-source into main 2026-10-08 02:19:43 +00:00
Owner

Approved FS-BUILD-02 build enabler

Canonical story. Remote CI/release now compile/package without rerunning test suites. Full local exact-candidate verification remains mandatory before integration.

Scope

  • Both workflows use clean jar; the release version is still exact.
  • Versioned release explicitly installs protected-lifecycle-disabled tooling dependencies and invokes npm run build (TypeScript compilation only).
  • All existing tests and Gradle test wiring/limits remain unchanged. Strict actual-workflow-command regressions cover development/versioned packaging and build failure before tool preparation.
  • README documents local proof, packaging commands and the distinction between remote packaging and remote tests.
  • No gameplay, credential/client/publisher, tag-recovery, runner or GitOps changes.

Exact local proof

Tested head: def83dcb32fe912cb9176c146d939c6790bdafb4; tree: 8b0331bd44ae3baa484c30366db13c6f48ba5bb8; tested target base: 1a1b1e06938c3d63fec88300ba7c799fbd686b9c. All 647 candidate SHA256s remain exact, manifest SHA256 f412f3cb49b89f457670d24da626f8464bafb47c2b7e2c3df61c9dc8b672fa46.

  • Meaningful workflow-command RED retained; final 55 tooling cases pass.
  • Actual clean jar -PreleaseVersion=1.159.1 produces valid JAR/resource pack and TypeScript CLI with no test tasks/results (9s).
  • Affected 447 API +55 tools pass, zero failures/errors/skips.
  • Full ./gradlew clean check jar -PreleaseVersion=1.159.1 --stacktrace passes 2,361 tests: 1,859 native +447 API +55 tools, zero failures/errors/skips, at existing Java25/native1GiB/limits (1,198s). Qualified 668 historical native SEVERE counts match prior complete same-production baseline by suite; no security-clearance claim.
  • Diff review/check passes; canonical OKF validation has zero errors/one retained historical frontmatter warning.

Logs/reports retained privately under /tmp/fs-build-02-*. Reconcile and rerun affected/full verification if target main advances; verify the actual fetched merge tree equals the tested tree.

Delivery boundary

Source merge can trigger semantic-release/artifact publication. CI success will be packaging proof, not remote test proof. Existing security findings/unfinished remediation, exact-source downloaded-artifact checks and GitOps/deployment approval remain separate and blocked as recorded. No GitOps push or deployment is authorized.

## Approved FS-BUILD-02 build enabler [Canonical story](https://git.garvis.dev/dmg/somc-okf/src/branch/main/user-stories/purpur-fantasy-stick/fs-build-02-package-locally-verified-source.md). Remote CI/release now compile/package without rerunning test suites. Full local exact-candidate verification remains mandatory before integration. ## Scope - Both workflows use `clean jar`; the release version is still exact. - Versioned release explicitly installs protected-lifecycle-disabled tooling dependencies and invokes `npm run build` (TypeScript compilation only). - All existing tests and Gradle test wiring/limits remain unchanged. Strict actual-workflow-command regressions cover development/versioned packaging and build failure before tool preparation. - README documents local proof, packaging commands and the distinction between remote packaging and remote tests. - No gameplay, credential/client/publisher, tag-recovery, runner or GitOps changes. ## Exact local proof Tested head: `def83dcb32fe912cb9176c146d939c6790bdafb4`; tree: `8b0331bd44ae3baa484c30366db13c6f48ba5bb8`; tested target base: `1a1b1e06938c3d63fec88300ba7c799fbd686b9c`. All 647 candidate SHA256s remain exact, manifest SHA256 `f412f3cb49b89f457670d24da626f8464bafb47c2b7e2c3df61c9dc8b672fa46`. - Meaningful workflow-command RED retained; final 55 tooling cases pass. - Actual `clean jar -PreleaseVersion=1.159.1` produces valid JAR/resource pack and TypeScript CLI with no test tasks/results (9s). - Affected 447 API +55 tools pass, zero failures/errors/skips. - Full `./gradlew clean check jar -PreleaseVersion=1.159.1 --stacktrace` passes **2,361 tests: 1,859 native +447 API +55 tools**, zero failures/errors/skips, at existing Java25/native1GiB/limits (1,198s). Qualified 668 historical native SEVERE counts match prior complete same-production baseline by suite; no security-clearance claim. - Diff review/check passes; canonical OKF validation has zero errors/one retained historical frontmatter warning. Logs/reports retained privately under `/tmp/fs-build-02-*`. Reconcile and rerun affected/full verification if target main advances; verify the actual fetched merge tree equals the tested tree. ## Delivery boundary Source merge can trigger semantic-release/artifact publication. CI success will be packaging proof, not remote test proof. Existing security findings/unfinished remediation, exact-source downloaded-artifact checks and GitOps/deployment approval remain separate and blocked as recorded. No GitOps push or deployment is authorized.
dmg added 1 commit 2026-10-08 02:15:51 +00:00
fix(ci): package locally verified source without remote tests
CI / build (push) Successful in 46s
CI / build (pull_request) Successful in 2m45s
def83dcb32
dmg merged commit 6563f61f19 into main 2026-10-08 02:19:43 +00:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dmg/purpur-fantasy-stick#8