coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: lock workflow checkout provenance
Some checks failed
Build and publish policy-nexus image / build-and-push (push) Failing after 48s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-09-01 00:37:12 +02:00
parent a0e4964b46
commit 8ea8a4b41c
2 changed files with 23 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

35
tools/build_site.py
View file

@ -48,27 +48,22 @@ def _source_revision(repo: Path, source: Path) -> str:
source_root = os.environ.get("POLICY_NEXUS_SOURCE_ROOT", "")
if source_root:
root = Path(source_root).resolve()
lock_path = root / "source-lock.json"
try:
repo.relative_to(root)
except ValueError:
pass
else:
lock_path = root / "source-lock.json"
try:
lock = json.loads(lock_path.read_text(encoding="utf-8"))
locked_revision = lock["repositories"][repo.name]["revision"]
except (KeyError, OSError, TypeError, json.JSONDecodeError) as exc:
raise ValueError(
f"{repo.name}: source revision is missing from {lock_path}"
) from exc
if not isinstance(locked_revision, str) or not CLEAN_GIT_REVISION.fullmatch(
locked_revision
):
raise ValueError(
f"{repo.name}: locked source revision must be a clean 40-hex Git commit, "
f"got {locked_revision!r}"
)
return locked_revision
lock = json.loads(lock_path.read_text(encoding="utf-8"))
locked_revision = lock["repositories"][repo.name]["revision"]
except (KeyError, OSError, TypeError, json.JSONDecodeError) as exc:
raise ValueError(
f"{repo.name}: source revision is missing from {lock_path}"
) from exc
if not isinstance(locked_revision, str) or not CLEAN_GIT_REVISION.fullmatch(
locked_revision
):
raise ValueError(
f"{repo.name}: locked source revision must be a clean 40-hex Git commit, "
f"got {locked_revision!r}"
)
return locked_revision
try:
head = subprocess.run(
["git", "-C", str(repo), "rev-parse", "HEAD"],