DEV-137: Make build_runner optional - #3
Merged
Conversation
grafele
added a commit
that referenced
this pull request
Aug 5, 2026
…the identifiers
Moving all of it out went too far. The WI now carries the technical shape at process level and Annex B
only what it alone holds.
Back in the WI:
§1.2 when observation happens — the four points in time, what each asks, and which record it
produces. With the dependency drawn: stage #3 produces the document stage #4 reads, stage #4
produces the records stage #7 reconciles.
§6.2 the maintenance window grid, drawn. A finding reported between two windows falls due in the
second one, and a missed window does not move the grid.
§7.1 the steps inside the two automated stages, in order, because the order is what makes them
auditable: an unlisted artefact stops the run before anything is scanned, an image is recorded
by its digest rather than the tag that was requested, and the deployed version comes from the
deployment record rather than from the newest tag.
§7.2 which build produces evidence — candidate, staging, branch, and what each may be used as.
Still no file name, script name or configuration key in the WI: those are Annex B's job and repeating
them in a controlled document means two places to update.
Annex B went from 1195 to 356 lines. Nine of its sixteen sections had become duplicates of WI sections
after the restructure — classification, deadlines, what carries the deadline, currency, escalation,
roles, the overview, the limitations, the review items. Two documents stating the same rule is how they
drift apart, so those are gone and what remains is the reference: which script does what, which files a
run produces, the three files a project owns, the configuration keys with their defaults, the object
store prefixes, the `quickbird:` properties recorded in the document, and the implementation limits.
Annex A's cross-references pointed at the old numbering and are remapped to the WI.
139 tests, 5 against live feeds.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
grafele
added a commit
that referenced
this pull request
Aug 5, 2026
The pipeline supports SOUP_POLICY_FILE and nothing in CI ever set it. The action had no policy input, so the assessment stage — vulnerabilities, classification, currency, units — silently skipped on every CI run, leaving a components-only bundle where the WI requires an assessed one (§7 stage #3 step 6). The local runs all passed the policy by hand, which is why 154 tests and a full review missed it: the gap was in the wiring between the action and the pipeline, visible only on a real runner. New `policy-file` input, default `.soup-policy.yml`, resolved against the repo root. Absent file keeps the existing warning-and-skip behaviour, which is right for a product that has not adopted a policy yet. Also from the same run: the private-repo asset download. The monitor fetched release assets via browser_download_url with a bare curl, which only answers an authenticated browser session — on this org every repo is private. resolve-deployed.sh now emits the API asset URL and the monitor downloads it through gh with the octet-stream Accept header. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds 'RUN_BUILD_RUNNER' flag to the env file which can be optionally set.
If the flag is not set or set to 'true' it will run the
flutter pub run build_runner build --delete-conflicting-outputscommand. It will not run the command if it is set to 'false'.