ci: gate repositories on released okf binaries - #24
Merged
Conversation
This was referenced Aug 18, 2026
chrishiguto
force-pushed
the
feature/4-base-finding-ids
branch
from
August 19, 2026 13:01
597b25f to
4bc079f
Compare
chrishiguto
force-pushed
the
feature/14-ci-gate
branch
from
August 19, 2026 13:27
0d93307 to
440026f
Compare
leoafarias
force-pushed
the
feature/4-base-finding-ids
branch
from
August 21, 2026 14:59
95dbbe5 to
5549afc
Compare
leoafarias
force-pushed
the
feature/14-ci-gate
branch
from
August 21, 2026 15:55
61248e6 to
cd77313
Compare
Publish pinned release binaries and provide a thin composite action that delegates validation and exit policy to the okf executable. Fixes #14 Co-authored-by: Christiano Higuto <christiano.higuto.c@conceptatech.com>
leoafarias
force-pushed
the
feature/14-ci-gate
branch
from
August 21, 2026 15:59
cd77313 to
3963f44
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Consumers need an OKF Spec conformance gate without installing Dart or reimplementing the engine's exit policy.
What
Tagged releases validate the exact tag commit, compile
okf-linux-x64andokf-macos-arm64, and publish them only when immutable releases are enabled. The installer verifies GitHub's signed release-asset attestation before making a downloaded engine executable.The root composite action infers its explicitly pinned engine tag from the action ref (or accepts an override), downloads the matching binary, and executes one
okf validateinvocation. Its process exit status is the verdict; the action parses no report and computes no exit code.A consumer needs only checkout plus
uses: conceptadev/okf@v0.2.0. Bundle defaults to the repository root; optional strict mode passes the canonical--strictflag.Workflow actions use their current releases pinned to full commit SHAs. Weekly Dependabot updates keep those immutable pins and version comments current through reviewable PRs, without runtime tag drift.
Reviewer's guide
Start with
action.yml,.github/workflows/release.yml,tool/ci/install-engine.sh, andtest/ci_gate_test.dart. This PR builds on the merged Spec validation work and is independent of the graph/MCP stack.Testing
dart pub publish --dry-runreports zero warnings and excludes infrastructure-only tests.dart compile exeproduces a workingokf 0.2.0binary.Repository immutable releases are enabled for all future releases.
Links
Fixes #14.