[ABI] Publish exact immutable staging requests - #1261
Merged
Conversation
Clean exact-head request classification ran the candidate ABI check before either SDK sysroot existed. ABI 43 therefore produced an invalid structural report even though its snapshot was consistent. Materialize the exact pinned musl source, build both SDK sysroots inside the stripped candidate environment, and keep the classifier fail-closed. Bind the workflow change in request policy v14 and extend the mutation coverage.
brandonpayton
changed the title
GitHub immutable releases reject assets appended after publication, so the active request feed could create an empty public prerelease but could not publish its request bytes. That stopped tap reconciliation before any staged bottle build could begin. Give each canonical request a digest-addressed tag and prerelease. Create the release as a draft, upload and authenticate the one exact request, publish it once, then require immutable state plus anonymous byte-for-byte readback. Bind the direct tag, release target, issuer workflow, and protected main commit together, and rotate request policy to version 15.
brandonpayton
force-pushed
the
emdash/fix-abi-request-sysroot
branch
from
August 13, 2026 07:29
bbf388a to
3a1bae5
Compare
brandonpayton
enabled auto-merge (squash)
August 13, 2026 07:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The exact-head request feed is the first handoff from a Kandelo pull
request to staged Homebrew bottle builds. ABI 43 could not reach that
handoff for two independent reasons.
First, the clean exact-head classifier ran the ABI check before its SDK
sysroots existed. Second, GitHub release immutability prevented the
active publisher from appending request bytes to an already-public
prerelease. The latter left an empty immutable release for the first
canary and stopped tap reconciliation before any bottle build began.
This change makes request publication compatible with immutable GitHub
releases while keeping candidate execution and all registry writes out
of Automattic/kandelo.
What changed
sysroots before structural ABI classification.
direct protected-commit tag.
request, publish it once, then require immutable state and anonymous
byte-for-byte readback.
freshly recaptured protected main commit.
classifier and publisher implementation.
Validation
scripts/dev-shell.sh bash scripts/test-abi-staging-request-feed.shpassed, including 25 focused Rust tests.
idempotent, collision, moved-main, and hostile-tag cases.
actionlint .github/workflows/abi-staging-request-feed.ymlpassed.5669d27fa171ad1bccf50031914dc6d997666276previously passed the clean structural classifier once both exact
sysroots were built.
pull_request_targetintentionally executes the protected mainworkflow, not this pull request's publisher bytes.
Rollout
Merge this PR first. A protected-main request-feed run will then publish
the current ABI 43 request. The tap activation PR can anonymously read
that exact immutable request and start Kandelo-dev candidate bottle work.