From 9a3a2409087ebe1b6f9026f5486ce583d1c8ab26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=A9o=20H=2E=20Petel?= <113530345+fraware@users.noreply.github.com> Date: Wed, 26 Aug 2026 14:03:48 -0700 Subject: [PATCH 1/2] fix: upload hidden consumer verification evidence --- .github/workflows/consumer-pin-verification.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/consumer-pin-verification.yml b/.github/workflows/consumer-pin-verification.yml index b84e5b65..2986625f 100644 --- a/.github/workflows/consumer-pin-verification.yml +++ b/.github/workflows/consumer-pin-verification.yml @@ -156,3 +156,4 @@ jobs: name: consumer-pin-${{ strategy.job-index }} path: .verification/consumer-pin-*.json if-no-files-found: error + include-hidden-files: true From fca749bc53fb96255787388cc49da0d169fb4cd4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=A9o=20H=2E=20Petel?= <113530345+fraware@users.noreply.github.com> Date: Wed, 26 Aug 2026 14:04:08 -0700 Subject: [PATCH 2/2] test: require hidden consumer evidence upload --- tests/test_workflow_dispatch_contracts.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/tests/test_workflow_dispatch_contracts.py b/tests/test_workflow_dispatch_contracts.py index 4f743f43..891f8457 100644 --- a/tests/test_workflow_dispatch_contracts.py +++ b/tests/test_workflow_dispatch_contracts.py @@ -102,3 +102,18 @@ def test_consumer_pin_verification_exposes_typed_release_inputs() -> None: assert inputs["ovk_candidate_sha"]["required"] == "true" assert inputs["fastapi_ref"]["default"] == "main" assert inputs["express_ref"]["default"] == "main" + + +def test_consumer_pin_verification_uploads_hidden_evidence() -> None: + """Evidence written under `.verification` must not be silently omitted from artifacts.""" + + path = WORKFLOW_DIR / "consumer-pin-verification.yml" + workflow = _load_workflow(path) + steps = workflow["jobs"]["verify-consumer-pins"]["steps"] + upload_steps = [step for step in steps if step.get("name") == "Upload consumer pin evidence"] + + assert len(upload_steps) == 1 + upload = upload_steps[0] + assert upload["with"]["path"].startswith(".verification/") + assert upload["with"]["if-no-files-found"] == "error" + assert upload["with"]["include-hidden-files"] == "true"