ci: requalify immutable SDK candidates as the protected consumer advances (8bc16609) · Commits · OOP / code / transformation-function-sdk

.gitlab-ci.yml

+2 −3

Changes for .gitlab-ci.yml: 2 added lines, 3 removed lines.
Original line number	Diff line number	Diff line
		@@ -115,7 +115,7 @@ dependency-audit:
		script:
		- python ci/security.py dependencies
		rules:
		- if: $CI_COMMIT_TAG \|\| $CI_PIPELINE_SOURCE == "schedule"
		- if: $CI_COMMIT_TAG \|\| $CI_PIPELINE_SOURCE == "schedule" \|\| $RUN_EXTENDED == "1"
		- when: manual
		allow_failure: true
		artifacts:
		@@ -146,7 +146,7 @@ python-compatibility:
		- job: build-package
		artifacts: true
		rules:
		- if: $CI_COMMIT_TAG \|\| $CI_PIPELINE_SOURCE == "schedule"
		- if: $CI_COMMIT_TAG \|\| $CI_PIPELINE_SOURCE == "schedule" \|\| $RUN_EXTENDED == "1"
		script:
		- python ci/verify.py tests
		artifacts:
		@@ -202,7 +202,6 @@ srm-consumer:
		SDK_SOURCE_SHA: $SDK_SOURCE_SHA
		SDK_WHEEL_NAME: $SDK_WHEEL_NAME
		SDK_WHEEL_SHA256: $SDK_WHEEL_SHA256
		EXPECTED_SRM_SHA: "37c6033f31ddf106761dd2996ee8ed85237c70d8"
		trigger:
		project: oop/code/service-resource-manager
		branch: codex/tfsdk-consumer-qualification

+6 −0

Changes for ci/README.md: 6 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -43,3 +43,9 @@ qualification files are maintainer-reviewed receipts, not signed attestations or
		a claimed SLSA level. Each SRM/E2E receipt must carry the same SDK SHA/checksum
		and a pipeline URL in its owning ETSI project. Keep final publication blocked
		until the release scope and the corresponding live evidence are agreed.

		Consumer qualification follows a protected SRM candidate branch. GitLab fixes
		the downstream checkout when creating that pipeline, and its receipt records
		the exact consumer revision. Advancing SRM can requalify the same immutable SDK
		artifact without changing the package or inventing a new SDK version. Use
		RUN_EXTENDED=1 to run the full Python/security matrix in a web pipeline too.