@plasius/gpu-model-runtime 0.2.4 → 0.2.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +15 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -216,9 +216,22 @@ Apache-2.0. See LICENSE, SECURITY.md, and the files under legal/.
|
|
|
216
216
|
## Release integrity
|
|
217
217
|
|
|
218
218
|
CI keeps the administrative contributor registry outside Git and npm package
|
|
219
|
-
artifacts using exact, case-normalised path checks. CI
|
|
220
|
-
|
|
219
|
+
artifacts using exact, case-normalised path checks. CI accepts only branch pushes
|
|
220
|
+
in this repository and uses the `Public CI - Quarantined` runner group with
|
|
221
|
+
explicit `[self-hosted, Linux, X64]` labels. Pull requests and fork events cannot
|
|
222
|
+
execute these jobs. The group admits the reviewed `ci.yml` on `main`; a reviewed
|
|
223
|
+
branch ref can be temporarily admitted for PR validation after its exact workflow
|
|
224
|
+
commit SHA is reviewed and recorded, then removed after merge. A SHA-only entry
|
|
225
|
+
does not admit a branch-triggered run; use the exact reviewed branch ref. Each job has a timeout and a newer push
|
|
226
|
+
cancels stale validation for the same ref. Publication uses the GitHub-hosted `production` job with
|
|
221
227
|
Node 24 and a pinned npm 11.6.2 client. It is token-free and proceeds only while the prepared SHA
|
|
222
228
|
is the exact `main` head after successful push-triggered CI. Do not dispatch CD
|
|
223
229
|
until the npm trusted-publisher binding is verified.
|
|
230
|
+
|
|
231
|
+
The parent rollout flag `platform.public-artifact-integrity.enabled` stages public
|
|
232
|
+
distribution; enabled, disabled and rollback states all retain mandatory artifact
|
|
233
|
+
admission and runner/publication boundaries. To roll back an unsafe channel,
|
|
234
|
+
disable the affected workflow through GitHub Actions and restore the last reviewed
|
|
235
|
+
workflow through a forward PR; never add hosted CI fallback, token publication or
|
|
236
|
+
restore excluded administrative files. See [ADR-0009](docs/adrs/adr-0009-quarantined-self-hosted-ci.md).
|
|
224
237
|
<!-- END PLASIUS RELEASE INTEGRITY -->
|