Problem
A verified Windows MSI can be omitted from an otherwise successful immutable nightly release when the provenance transparency service returns a transient error after the package has built and passed verification. Rerunning only the failed Windows job uploads its artifact too late for the already-completed immutable publication stage.
Scope
- Retry the pinned Windows MSI provenance-attestation action once in nightly and curated prerelease workflows.
- Keep attestation mandatory before the MSI artifact can be uploaded.
- Extend the release workflow contract to lock the retry and fail-closed behavior.
Acceptance criteria
- Nightly and curated prerelease Windows packaging each retry one failed provenance-attestation attempt.
- A successful first attempt does not make a redundant service request.
- A failed second attempt stops the Windows job before artifact upload.
- Both attempts use the same pinned attestation action and the same verified MSI subject.
- Repository validation detects removal or weakening of the retry contract.
Relationships
Parent
Problem
A verified Windows MSI can be omitted from an otherwise successful immutable nightly release when the provenance transparency service returns a transient error after the package has built and passed verification. Rerunning only the failed Windows job uploads its artifact too late for the already-completed immutable publication stage.
Scope
Acceptance criteria
Relationships
Parent