Record native build provenance

This commit is contained in:
vineyardbovines
2026-09-03 17:26:36 -04:00
parent 39e591e154
commit 3c9b072dea
3 changed files with 143 additions and 16 deletions
+4
View File
@@ -59,3 +59,7 @@ The release model can be exercised locally with `node scripts/release/cli.mjs`.
## Manual preview
The **Prepare Cactus Release** workflow accepts a release version and optional source ref. It validates the checked-out package and Expo versions, generates a provisional changelog from commit titles, uploads the prepared release document as an artifact, and summarizes every derived identifier. It has read-only repository permissions and does not create a branch, tag, commit, or GitHub Release.
## Build provenance
Native build artifacts are retained with metadata recording their exact source SHA, package version, artifact-derived build number, filename, SHA-256 checksum, and submission state. Store submission can be disabled so production-profile artifacts can be inspected without publishing them.