commit d395b375a0af64690b76bea6afc6e21ab18c5f34 parent 55bbcedf5679b5a15d4e7c2c25bee29825f009a6 Author: triesap <tyson@radroots.org> Date: Fri, 4 Sep 2026 21:51:14 +0000 Keep advisory scans outside unsigned gate - keep the Step 290 boundary limited to exact unsigned package verification - defer live RustSec and OWASP analysis to governed snapshot qualification - retain dependency analysis on the separate release readiness path - reject out-of-order advisory commands in unsigned gate regressions Diffstat:
4 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/Makefile b/Makefile @@ -177,8 +177,7 @@ _unsigned-release-check: export HARVESTCIRCLE_BUILD_RUST_TOOLCHAIN = 1.97.1 _unsigned-release-check: export SOURCE_DATE_EPOCH = $(shell git show -s --format=%ct HEAD) _unsigned-release-check: doctor @test "$(BUILD_MODE)" = governed || { printf '%s\n' 'unsigned-release-check requires governed mode'; exit 2; } - $(BUILD_RUNNER) $(CARGO) audit --file core/Cargo.lock - $(BUILD_RUNNER) $(CARGO) deny --manifest-path $(CARGO_MANIFEST) check --config core/deny.toml advisories licenses sources + $(BUILD_RUNNER) $(CARGO) deny --manifest-path $(CARGO_MANIFEST) check --config core/deny.toml licenses sources $(BUILD_RUNNER) $(GRADLE) --no-daemon --no-parallel --no-configuration-cache :app:desktop:unsignedReleaseReadiness signing-check: diff --git a/build-logic/plugins/src/functionalTest/kotlin/org/harvestcircle/buildlogic/plugins/ConventionPluginSmokeTest.kt b/build-logic/plugins/src/functionalTest/kotlin/org/harvestcircle/buildlogic/plugins/ConventionPluginSmokeTest.kt @@ -485,6 +485,7 @@ class ConventionPluginSmokeTest { assertTrue(unsigned.output.contains(":app:desktop:packageDmg"), unsigned.output) assertTrue(unsigned.output.contains(":app:desktop:verifyMacOsPackage"), unsigned.output) listOf( + ":app:desktop:dependencyCheckAnalyze", ":app:desktop:signingReadiness", ":app:desktop:notarizationReadiness", ":app:desktop:verifyMacOsDeveloperIdSignature", @@ -504,6 +505,7 @@ class ConventionPluginSmokeTest { ) .build() assertTrue(signed.output.contains(":app:desktop:unsignedReleaseReadiness"), signed.output) + assertTrue(signed.output.contains(":app:desktop:dependencyCheckAnalyze"), signed.output) assertTrue(signed.output.contains(":app:desktop:signingReadiness"), signed.output) assertTrue(signed.output.contains(":app:desktop:notarizationReadiness"), signed.output) } diff --git a/build-logic/plugins/src/main/kotlin/org/harvestcircle/buildlogic/plugins/HarvestCirclePackagingPlugin.kt b/build-logic/plugins/src/main/kotlin/org/harvestcircle/buildlogic/plugins/HarvestCirclePackagingPlugin.kt @@ -259,7 +259,6 @@ public class HarvestCirclePackagingPlugin : Plugin<Project> { } task.dependsOn( "checkLicense", - "dependencyCheckAnalyze", sourceReadiness, packageReadiness, "packageDmg", @@ -267,7 +266,12 @@ public class HarvestCirclePackagingPlugin : Plugin<Project> { ) } target.tasks.register("releaseReadiness") { task -> - task.dependsOn(unsignedReleaseReadiness, signingReadiness, notarizationReadiness) + task.dependsOn( + "dependencyCheckAnalyze", + unsignedReleaseReadiness, + signingReadiness, + notarizationReadiness, + ) } target.tasks.named("check") { it.dependsOn(verifyMetadata) } } diff --git a/tools/test-build-modes.sh b/tools/test-build-modes.sh @@ -124,9 +124,9 @@ if ! printf '%s\n' "$unsigned_release_output" | grep -q ':app:desktop:unsignedRe printf '%s\n' 'unsigned release command did not select the unsigned readiness gate' >&2 exit 1 fi -for forbidden in ':app:desktop:releaseReadiness' ':app:desktop:signingReadiness' ':app:desktop:notarizationReadiness'; do +for forbidden in 'cargo audit' 'advisories' ':app:desktop:dependencyCheckAnalyze' ':app:desktop:releaseReadiness' ':app:desktop:signingReadiness' ':app:desktop:notarizationReadiness'; do if printf '%s\n' "$unsigned_release_output" | grep -q "$forbidden"; then - printf '%s\n' "unsigned release command activated signer authority: $forbidden" >&2 + printf '%s\n' "unsigned release command activated out-of-scope authority: $forbidden" >&2 exit 1 fi done