[DO NOT MERGE] Validate the signing config for #23261 - #23267
Closed
mokagio wants to merge 2 commits into
Closed
Conversation
[DO NOT MERGE] Throwaway validation for #23261, closed once it has answered. Nothing in the PR pipeline exercises release signing: prototype builds assemble the `Debug` build type, lint and the manifest diffs never sign, and `release-builds.yml` and `beta-builds.yml` are API-triggered from release automation and check out a release branch rather than the PR. The first run that would notice a broken release signing config is the scheduled trunk-internal build, after merge. The debug side is worse than uncovered: when the shared keystore is absent AGP falls back to `~/.android/debug.keystore` and the build still goes green, so every prototype build so far has passed without proving the renamed `debug.keystore` was ever read. Both negative cases run against a throwaway `user.home` holding symlinks to the real credentials, so the agent's secrets directory is never mutated and no decrypted secret is copied anywhere. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com>
--- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com>
Collaborator
Generated by 🚫 Danger |
Contributor
|
|
Contributor
|
|
5 tasks
Contributor
Author
|
Validation ran green on build #28383 — every signing-config assertion passed against the Posted by Claude (Opus 5) on behalf of @mokagio with approval. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Validation only. Do not merge.
Re-run of #23266 after #23261 kept
.jksas the upload keystore extension.No PR job exercises release signing, so this branch adds a Buildkite step that runs
configure_applyon an agent and asserts on:WordPress:signingReport:Config: releasewith the store atupload.jksin the out-of-repo secrets directory, and a certificate reads out of it.debug.keystoreunder its new name.Config: none— the keystore file, notsecrets.properties, is what gates signing.The two negative cases run against a throwaway
user.homesymlinked to the real credentials, so the agent's secrets directory is never mutated.Testing instructions
Read the "🔐 Validate signing config" job. Every assertion prints
PASS:orFAIL:and the step fails on anyFAIL:.Close once it has answered; never merge.
Posted by Claude (Opus 5) on behalf of @mokagio with approval.