Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepared-workspace packaging could emit evidence from a different dependency graph than the executable. This owner fix keeps native inventory on the prepared workspace and cross-target inventory on its pinned graph, and strengthens public Package regressions to validate source attachment, linked sibling modules, graph edges and executable digest. It reuses Core inventory and artifact attachment; no second scanner is introduced.
This is a follow-up to #159, targeting that existing branch. The current account cannot push to its owner branch, so the reviewed correction is supplied from a fork without rewriting its history. Core v0.19.10 adoption retains the existing ownership-writer path; it is not a release of this development agent.
BLOCKED pending the owner release/adoption of codefly-dev/core#878. The stronger test exposes a real existing Core multi-main inventory defect with the committed dependency. With an uncommitted workspace selecting reviewed Core2b077f2e, full service-go suite/build/vet and real native Darwin/arm64 + cross Linux/amd64 CGO packaging pass. Core source review closed root, graph and alternate-manifest defects. No committed pseudo-version or replace bypass is proposed.
Normal CLI0.1.233 bootstraps its packager with the committed Core pin, so local final-executable substitution alone still emits incomplete evidence. Repeat CLI packaging and clean/generated delivery after released adoption. Linux process-lifecycle qualification remains open; cross-compilation is not Linux execution. Exact reviewed source60d721eddbc62de4a069b740fc83612b5c0ed068. Keep draft; do not merge this dependent follow-up as-is.