Record native build provenance
This commit is contained in:
@@ -59,3 +59,7 @@ The release model can be exercised locally with `node scripts/release/cli.mjs`.
|
||||
## Manual preview
|
||||
|
||||
The **Prepare Cactus Release** workflow accepts a release version and optional source ref. It validates the checked-out package and Expo versions, generates a provisional changelog from commit titles, uploads the prepared release document as an artifact, and summarizes every derived identifier. It has read-only repository permissions and does not create a branch, tag, commit, or GitHub Release.
|
||||
|
||||
## Build provenance
|
||||
|
||||
Native build artifacts are retained with metadata recording their exact source SHA, package version, artifact-derived build number, filename, SHA-256 checksum, and submission state. Store submission can be disabled so production-profile artifacts can be inspected without publishing them.
|
||||
|
||||
Reference in New Issue
Block a user