Skip to content

Commit CI Preflight v0.1.0-rc.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@MarcoPorcellato MarcoPorcellato released this 10 Aug 09:22
· 37 commits to main since this release
v0.1.0-rc.1
ceb164a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Commit CI Preflight v0.1.0-rc.1

First public release candidate of Commit CI Preflight, an independent Apache-2.0 Rust CLI for moving reproducible heavy CI checks to developer-owned hardware while keeping a small exact-head evidence gate on GitHub.

Included

  • deterministic plan, doctor, dry-run, run, verify, cache, benchmark, and GitHub Actions migration-assistant commands;
  • pinned Docker-compatible Linux execution with read-only source mounts and bounded writable caches;
  • canonical commit-bound receipt v1 and independent fail-closed policy verification;
  • lightweight GitHub receipt gate that does not rerun project tests;
  • persistent cache ownership and preview-only cleanup;
  • native benchmark evidence for macOS arm64, Linux x86_64, and Windows x86_64;
  • SBOM, third-party notices, threat model, installation, rollback, support, and tutorial documentation;
  • a human-readable two-row workflow diagram in the README.

Reviewed assets

  • commit-ci-preflight-v0.1.0-aarch64-apple-darwin.tar.gz — unsigned macOS arm64 archive;
  • SHA256SUMS — checksum manifest for that archive.

Archive SHA-256:

1f0307ade4d904f82405a3779311248cb4ffb2e3746ea5bf7699b92c07109ed6

Verify on macOS:

shasum -a 256 -c SHA256SUMS

Qualification receipt

  • tagged commit: ceb164a0d13d53075b222dd8a4402fe0084fab18;
  • exact-main local preflight: format, test, Clippy, docs, and release metadata PASS;
  • independent receipt verification: integrity, policy, and decision PASS;
  • receipt ID: sha256:89159f93bc5cb84807a85f8cece611ad05adbc1d16e0373232bb2b002ddf8a4b;
  • append-only evidence branch: ccp-evidence/ceb164a0d13d53075b222dd8a4402fe0084fab18.

Important boundaries

  • the archive and checksum are not signed and do not establish publisher identity;
  • complete run qualification on native Linux and Windows remains pending; their fixed benchmark receipts do not imply full runtime qualification;
  • containers are not represented as a complete sandbox for actively hostile code;
  • no crate, Homebrew formula, Winget package, container image, marketplace listing, or signed artifact is published;
  • receipts contain integrity and repository-policy evidence, not identity attestation.

Use this prerelease for evaluation and controlled beta testing. Review the threat model and repository policy before relying on it for security-sensitive enforcement.

Assets 4
Loading