Skip to content

distribution.md

Latest commit

 

History

History
88 lines (69 loc) · 4.43 KB

distribution.md

File metadata and controls

88 lines (69 loc) · 4.43 KB
Raw

Distribution Plan

These items require release infrastructure, registry credentials, domains, or GitHub repository settings. They are tracked here so the project has a clear path beyond source installs.

Package Channels

  • agents-shipgate is published on PyPI.
  • Pinned GitHub Action release tags are published, including v0.15.0.
  • GitHub Releases attach the independently qualified wheel, SBOM, safety-qualification.json, and their Sigstore bundles. The tag workflow does not rebuild or publish an unqualified sdist.
  • Evaluate a container image later only if it has an exercised build-and-test path.
  • Evaluate Homebrew once CLI usage warrants it.

The GitHub Action installs from its tagged source by default. A shipgate_version input is available for release flows that intentionally need to install a published PyPI version.

Supply Chain

  • Generate SBOMs for release artifacts.
  • Sign release artifacts with Sigstore.
  • Publish to PyPI through Trusted Publishing from .github/workflows/release.yml.
  • Keep GitHub Actions pinned by SHA.
  • Use Dependabot for Python and GitHub Actions updates.
  • Add a lockfile for release and dev dependency builds once packaging workflow is finalized.

PyPI Trusted Publishing is configured for this repository's tag-triggered release workflow and protected pypi environment.

Protected qualification inputs

Every tag release now fails closed unless the protected pypi environment provides all six variables below. Values must be populated by the independent benchmark-owner promotion flow after it runs the frozen corpus against the exact wheel and signs safety-qualification.json:

Environment variable Required value
SAFETY_QUALIFICATION_WHEEL_URL HTTPS URL for the exact qualified wheel
SAFETY_QUALIFICATION_WHEEL_FILENAME Safe wheel basename, for example agents_shipgate-0.16.0b6-py3-none-any.whl
SAFETY_QUALIFICATION_JSON_URL HTTPS URL for the production-qualified JSON artifact
SAFETY_QUALIFICATION_SIGSTORE_BUNDLE_URL HTTPS URL for that JSON artifact's Sigstore bundle
SAFETY_QUALIFICATION_SIGNER_IDENTITY Exact trusted certificate identity configured for qualification promotion
SAFETY_QUALIFICATION_OIDC_ISSUER Trusted OIDC issuer, normally https://token.actions.githubusercontent.com for GitHub Actions

The release workflow verifies the signature identity first, then validates the artifact's production policy, 100-case invariants, tag/version, and wheel SHA-256. It copies and publishes that exact wheel only; it never rebuilds the package after qualification. Missing variables, non-HTTPS URLs, an unsafe filename, an invalid signature, a non-production result, or any binding mismatch stops before PyPI publication. Protect variable updates with required environment reviewers who are independent of the release initiator.

This is a configured trust root, not proof of organizational independence. The promotion job trusts the signed qualification summary and does not replay its underlying verifier receipts. The four-week, three-design-partner rollout is likewise an external beta stop condition; the machine gate enforces only the qualification artifact's combined minimum of 40 real-history, rejected/reverted, or design-partner origins.

Marketplace And Site

  • ThreeMoonsLab/agents-shipgate is listed on GitHub Marketplace.
  • Create a small landing page with install instructions, trust model, and findings gallery.
  • Consider a local-only playground later; do not accept private customer manifests into a hosted service without a separate privacy review.

Release Fan-Out Checklist

The tag-triggered release workflow publishes PyPI artifacts and creates the GitHub release. After each release tag, verify the external surfaces that live outside this repository:

  • PyPI shows the new package version.
  • GitHub Marketplace shows the new release tag as Latest.
  • The website header, footer, /llms.txt, and /.well-known/agents-shipgate.json show the new version.
  • Website discovery metadata points at the current report schema and GitHub Action pin.
  • /sitemap.xml resolves to the current sitemap or redirects to /sitemap-index.xml.

Marketplace Repository Notes

The repository keeps a root action.yml for GitHub Marketplace publication and a minimal .github/workflows/ci.yml for project validation plus a tag-triggered release workflow. The action remains a composite action; there is no Docker action entrypoint in the current release.