Skip to content

fix: Pin reviewed main frontend release 084ba428 #1089

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pigbibi merged 1 commit into from
Nov 8, 2026
Merged

fix: Pin reviewed main frontend release 084ba428 #1089

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 34 additions & 8 deletions .github/workflows/deploy-strategy-switch-console.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1040,7 +1040,25 @@ jobs:
if [ "$(git rev-parse HEAD)" != "$RELEASE_SOURCE_SHA" ] || [ "$(git rev-parse 'HEAD^{tree}')" != "$expected_tree" ]; then exit 2; fi
exit 0
fi
# Reviewed merged main release: keep all receiver checks and live configuration.
# Current reviewed merged main release: keep all receiver checks and live configuration.
# The earlier reviewed main remains an exact historical source in the next block.
if [ "$RELEASE_SOURCE_SHA" = "084ba4281cfff3304cf226ce511a2fc0a6b67b08" ]; then
[ "$GITHUB_REF" = "refs/heads/main" ] && [ "$frontend_mode" = true ] \
&& [ "$SYNC_SECRETS" = false ] && [ "$SYNC_STRATEGY_PROFILES" = false ] \
&& [ "$SKIP_BINANCE_RECEIVER_CHECKS" = false ] || exit 2
control_sha="$(git rev-parse HEAD)"
[ "$control_sha" = "$GITHUB_SHA" ] || exit 2
git cat-file -e "${RELEASE_SOURCE_SHA}^{commit}"
git merge-base --is-ancestor "$RELEASE_SOURCE_SHA" "$control_sha"
expected_tree="23f94567c2e8b631e8ef035bfea497acef795123"
[ "$(git rev-parse "${RELEASE_SOURCE_SHA}^{tree}")" = "$expected_tree" ] || exit 2
[ "$(git rev-parse "${RELEASE_SOURCE_SHA}:web/strategy-switch-console/v2_asset_map.js")" = "5287f259185ed44f3784aa6374cb00412b3c6238" ] || exit 2
git -c advice.detachedHead=false checkout --detach "$RELEASE_SOURCE_SHA"
[ "$(git rev-parse HEAD)" = "$RELEASE_SOURCE_SHA" ] \
&& [ "$(git rev-parse 'HEAD^{tree}')" = "$expected_tree" ] || exit 2
exit 0
fi
# Historical reviewed merged main release: same receiver and configuration gates.
if [ "$RELEASE_SOURCE_SHA" = "c1b737d6e721eb9fe71a12c613fbb49d3fa51563" ]; then
[ "$GITHUB_REF" = "refs/heads/main" ] && [ "$frontend_mode" = true ] \
&& [ "$SYNC_SECRETS" = false ] && [ "$SYNC_STRATEGY_PROFILES" = false ] \
Expand Down Expand Up @@ -1144,12 +1162,19 @@ jobs:
if: inputs.release_frontend_assets && inputs.source_sha != '20dad166be317dd0d57e492ed06e56dfb82b7aef' && !inputs.render_and_compare_only
run: |
set -euo pipefail
reviewed_main="c1b737d6e721eb9fe71a12c613fbb49d3fa51563"
if [ "$(git rev-parse HEAD)" = "$reviewed_main" ]; then
[ "$GITHUB_REF" = "refs/heads/main" ] \
&& [ "$(git rev-parse 'HEAD^{tree}')" = "5dcdab977ec72e32f99cd3ef4956cebff90ba107" ] || exit 2
[ "$(git hash-object web/strategy-switch-console/v2_asset_map.js)" = "b4ef57a6830011f78d0aa0270729e17d05a4d230" ] || exit 2
[ -z "$(git diff --name-only "$reviewed_main")" ] \
reviewed_main="084ba4281cfff3304cf226ce511a2fc0a6b67b08"
historical_reviewed_main="c1b737d6e721eb9fe71a12c613fbb49d3fa51563"
head_sha="$(git rev-parse HEAD)"
if [ "$head_sha" = "$reviewed_main" ] || [ "$head_sha" = "$historical_reviewed_main" ]; then
[ "$GITHUB_REF" = "refs/heads/main" ] || exit 2
if [ "$head_sha" = "$reviewed_main" ]; then
[ "$(git rev-parse 'HEAD^{tree}')" = "23f94567c2e8b631e8ef035bfea497acef795123" ] || exit 2
[ "$(git hash-object web/strategy-switch-console/v2_asset_map.js)" = "5287f259185ed44f3784aa6374cb00412b3c6238" ] || exit 2
else
[ "$(git rev-parse 'HEAD^{tree}')" = "5dcdab977ec72e32f99cd3ef4956cebff90ba107" ] || exit 2
[ "$(git hash-object web/strategy-switch-console/v2_asset_map.js)" = "b4ef57a6830011f78d0aa0270729e17d05a4d230" ] || exit 2
fi
[ -z "$(git diff --name-only "$head_sha")" ] \
&& [ -z "$(git ls-files --others --exclude-standard)" ] || exit 2
exit 0
fi
Expand Down Expand Up @@ -1629,7 +1654,8 @@ jobs:
const statusCandidate = process.env.RELEASE_SOURCE_SHA === '68e3d4b69e706e2100f860c473ec657e9baf05ba';
const cpuCandidate = process.env.RELEASE_SOURCE_SHA === '974354b98ebe0cd55931baa03034d887d4fac560';
const integrated = controlRuntimeCandidate || controlAdminCandidate || historyCandidate || declarationCandidate || returnsCandidate || settingsCandidate || dailyCandidate || statusCandidate || cpuCandidate || process.env.RELEASE_SOURCE_SHA === '0dd2c0b3e73e890bc2c39ab0bae0eeb48c58470a';
const reviewedMain = process.env.RELEASE_SOURCE_SHA === 'c1b737d6e721eb9fe71a12c613fbb49d3fa51563';
const reviewedMain = process.env.RELEASE_SOURCE_SHA === '084ba4281cfff3304cf226ce511a2fc0a6b67b08'
|| process.env.RELEASE_SOURCE_SHA === 'c1b737d6e721eb9fe71a12c613fbb49d3fa51563';
const betaRelease = ibkrDaily || integrated || reviewedMain;
const flowMode = process.env.EXTERNAL_FLOW_ENABLE === 'true';
if (flowMode && process.env.RELEASE_SOURCE_SHA !== '1174db8e143f2a3689ca8e86cd547dc08461ff29') fail('external_flow_source_invalid');
Expand Down
15 changes: 11 additions & 4 deletions docs/console-execution-evidence.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,17 @@ The account and overview cards display the reason for unknown, broker environmen
## Reviewed main frontend release source

The manual console deployment entry accepts the pinned, reviewed merged main
frontend release with receiver checks retained. The selector verifies the exact
commit, its ancestry in the workflow control revision, its tree and its embedded
asset map before checking out the source. The build must reproduce that map and
leave no tracked or untracked changes; the legacy frontend overlay is not applied.
frontend release with receiver checks retained. The current pin is
`084ba4281cfff3304cf226ce511a2fc0a6b67b08` (parent
`395ddd561a16d38ae0d145e5a7e9bb7b60c44ae6`, tree
`23f94567c2e8b631e8ef035bfea497acef795123`, asset map
`5287f259185ed44f3784aa6374cb00412b3c6238`). The earlier reviewed main
`c1b737d6e721eb9fe71a12c613fbb49d3fa51563` remains an exact historical source
under the same gates. The selector verifies the exact commit, its ancestry in
the workflow control revision, its tree and its embedded asset map before
checking out the source. The build must reproduce that map and leave no tracked
or untracked changes; the legacy frontend overlay is not applied. This pin does
not enable strategy-profile synchronization or Meridian activation.

Publication uses version-pinned inheritance from the active Worker version for
every binding, including secrets. Latest-version lineage checks reject concurrent
Expand Down
Loading
Loading