ci: materialize Windows release provenance from run head - #125
Merged
Pedro Henrique Penna (ppenna) merged 2 commits intoSep 19, 2026
Merged
Conversation
The Windows package job compared Linux-built provenance against a mutable self-hosted checkout. The prior checkout-index remediation could complete without proving every kernel input came from the workflow run's commit, and dev failed again. Resolve the config and patch inventory from HEAD and write their raw run-head blobs before packaging. Cover the failure mode by staging CRLF variants in a temporary index and verifying immutable materialization restores the canonical bytes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Pedro Henrique Penna (ppenna)
September 19, 2026 03:19
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Stale non-HEAD patch files can still alter provenance and break Windows packaging.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Materializes Windows kernel provenance inputs directly from immutable HEAD blobs before release packaging.
Changes:
- Adds a provenance-input materialization CLI command.
- Replaces index-based Windows rematerialization.
- Adds CRLF/index-state regression coverage.
| File | Description |
|---|---|
.github/actions/package-release/action.yml |
Invokes immutable materialization before Windows packaging. |
scripts/nvx.py |
Exposes the new CLI command. |
scripts/nvx_tools/build.py |
Reads config and patch blobs from HEAD. |
scripts/test_nvx_tools.py |
Tests canonical restoration despite a mutated index. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Windows release packaging derives kernel provenance from the worktree after materializing run-head blobs. Remove patch files absent from HEAD so a persistent staged or untracked patch cannot alter the expected fingerprint. Extend the regression with a stale staged patch and verify materialization deletes it while restoring the committed inputs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Pedro Henrique Penna (ppenna)
September 19, 2026 03:27
View session
Pedro Henrique Penna (ppenna)
deleted the
fix-windows-release-provenance-blobs
branch
September 19, 2026 04:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
kernel/config-microvmand every kernel patch from rawHEADblobs before Windows release packagingRoot cause
CI run 35416685879, attempt 1 at
1f13439406a10fff2cd7ad0c79f7b61720aeeb52, failed inPlatform / Windows / WHP / Virtual machine->Package release:The remediation merged in #123 executed successfully immediately before packaging, but it still sourced the input list and bytes from the persistent checkout's mutable Git index. A fresh checkout and the complete reduced WHP platform sequence preserved all artifact hashes, while CRLF-tainted kernel inputs reproduced the exact package failure locally. Packaging therefore still lacked an immutable run-head boundary.
The new helper resolves the config and patch inventory from the workflow run's
HEAD, writes the raw committed blobs, and rejects a run head missing either class of input.Validation
35416685879guest and OpenVMM artifactspython scripts\nvx.py verifyvalidate-nvx: 236 NVX tests (1 skipped), 4 host-profile tests, and CLI smoke checks