From 4e436579cf099ed5bb14953ef3b5be0eda44f637 Mon Sep 17 00:00:00 2001 From: Nathan Gillett Date: Thu, 7 May 2026 22:23:52 -0500 Subject: [PATCH 1/3] fix(conformance): refresh root certificate/report for release Regenerate repo-root conformance artifacts from the pinned spec so published metadata reflects the current SDK and spec versions. Co-authored-by: Cursor --- conformance-certificate.json | 10 +++++----- conformance-report.json | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/conformance-certificate.json b/conformance-certificate.json index 28da5e7..882c67b 100644 --- a/conformance-certificate.json +++ b/conformance-certificate.json @@ -1,18 +1,18 @@ { "certificateVersion": "cert-v0.1.0", "issuer": "intentproof-ci", - "issuedAt": "2026-05-07T23:14:10.170Z", + "issuedAt": "2026-05-08T03:22:29.834Z", "subject": { "name": "intentproof-sdk-python", "language": "python", - "version": "0.1.2" + "version": "0.1.3" }, "spec": { - "specVersion": "spec-v2.0.0", + "specVersion": "spec-v2.0.1", "specFingerprint": "efaf4db5b5545d9f037d4ce7d2208a7aed7062e9ac417b3fa79ec2adc8bef165", - "specCommit": "e85575a22ed6a4503e7dfdc324d80c313daf8037" + "specCommit": "40d3d0b96ded3c86030f3606a0cd0e477f88895c" }, - "conformanceReportDigest": "d774972c7375acfd0261dc99d4eec75bb7c7c10a44aed0a00ad8d413c6f36dab", + "conformanceReportDigest": "418a441ef33dd9299dbbb06b9bc64cf5363076f981e227e0d075ff4ec23b282a", "claims": { "oracle": "intentproof-spec/run-conformance", "allPhasesPass": true diff --git a/conformance-report.json b/conformance-report.json index 48d0dc3..ddfe954 100644 --- a/conformance-report.json +++ b/conformance-report.json @@ -1,10 +1,10 @@ { - "specVersion": "spec-v2.0.0", + "specVersion": "spec-v2.0.1", "specFingerprint": "efaf4db5b5545d9f037d4ce7d2208a7aed7062e9ac417b3fa79ec2adc8bef165", "sdk": { "name": "intentproof-sdk-python", "language": "python", - "version": "0.1.2" + "version": "0.1.3" }, "environment": { "runtime": "node v22.22.0", @@ -23,5 +23,5 @@ "stream2": "aee9ba9cebe4c3491ab1f297fdf98bbf1eb1cc3bf4607a4b5d385299aaf08027" } }, - "generatedAt": "2026-05-07T23:14:09.820Z" + "generatedAt": "2026-05-08T03:22:29.460Z" } From 8515f495f681005870396271d799634f935ff9e2 Mon Sep 17 00:00:00 2001 From: Nathan Gillett Date: Thu, 7 May 2026 22:51:51 -0500 Subject: [PATCH 2/3] ci(conformance): require successful cert-bot push-back Use the cert bot app token for artifact commits and fail the workflow when push-back to the default branch is blocked. Co-authored-by: Cursor --- .github/workflows/ci.yml | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index de2f4a5..1bb0043 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -135,8 +135,18 @@ jobs: path: intentproof-spec/conformance-certificate.json if-no-files-found: error + - name: Mint cert-bot installation token + id: cert_bot_token + if: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master') && github.actor != 'github-actions[bot]' }} + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ vars.INTENTPROOF_CERT_BOT_ID }} + private-key: ${{ secrets.INTENTPROOF_CERT_BOT_PRIVATE_KEY }} + - name: Publish conformance certificate and report at repo root if: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master') && github.actor != 'github-actions[bot]' }} + env: + INTENTPROOF_CERT_BOT_TOKEN: ${{ steps.cert_bot_token.outputs.token }} run: | set -euo pipefail cp intentproof-spec/conformance-certificate.json conformance-certificate.json @@ -145,14 +155,12 @@ jobs: echo "No conformance artifact updates to commit." exit 0 fi - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git config user.name "intentproof-cert-bot[bot]" + git config user.email "intentproof-cert-bot[bot]@users.noreply.github.com" + git remote set-url origin "https://x-access-token:${INTENTPROOF_CERT_BOT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" git add conformance-certificate.json conformance-report.json git commit -m "chore(ci): update conformance certificate and report" - if ! git push; then - echo "::warning::Unable to push conformance artifacts from this workflow context; leaving check green and relying on artifact uploads." - exit 0 - fi + git push spec-golden-parity: runs-on: ubuntu-latest From 5b3b1d2d01f124aa73aa76b9321d4b977d694a95 Mon Sep 17 00:00:00 2001 From: Nathan Gillett Date: Thu, 7 May 2026 23:00:35 -0500 Subject: [PATCH 3/3] chore(ci): drop manual conformance artifact refresh Revert manual root artifact updates so CI cert-bot push-back remains the single source of truth. Co-authored-by: Cursor --- conformance-certificate.json | 10 +++++----- conformance-report.json | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/conformance-certificate.json b/conformance-certificate.json index 882c67b..28da5e7 100644 --- a/conformance-certificate.json +++ b/conformance-certificate.json @@ -1,18 +1,18 @@ { "certificateVersion": "cert-v0.1.0", "issuer": "intentproof-ci", - "issuedAt": "2026-05-08T03:22:29.834Z", + "issuedAt": "2026-05-07T23:14:10.170Z", "subject": { "name": "intentproof-sdk-python", "language": "python", - "version": "0.1.3" + "version": "0.1.2" }, "spec": { - "specVersion": "spec-v2.0.1", + "specVersion": "spec-v2.0.0", "specFingerprint": "efaf4db5b5545d9f037d4ce7d2208a7aed7062e9ac417b3fa79ec2adc8bef165", - "specCommit": "40d3d0b96ded3c86030f3606a0cd0e477f88895c" + "specCommit": "e85575a22ed6a4503e7dfdc324d80c313daf8037" }, - "conformanceReportDigest": "418a441ef33dd9299dbbb06b9bc64cf5363076f981e227e0d075ff4ec23b282a", + "conformanceReportDigest": "d774972c7375acfd0261dc99d4eec75bb7c7c10a44aed0a00ad8d413c6f36dab", "claims": { "oracle": "intentproof-spec/run-conformance", "allPhasesPass": true diff --git a/conformance-report.json b/conformance-report.json index ddfe954..48d0dc3 100644 --- a/conformance-report.json +++ b/conformance-report.json @@ -1,10 +1,10 @@ { - "specVersion": "spec-v2.0.1", + "specVersion": "spec-v2.0.0", "specFingerprint": "efaf4db5b5545d9f037d4ce7d2208a7aed7062e9ac417b3fa79ec2adc8bef165", "sdk": { "name": "intentproof-sdk-python", "language": "python", - "version": "0.1.3" + "version": "0.1.2" }, "environment": { "runtime": "node v22.22.0", @@ -23,5 +23,5 @@ "stream2": "aee9ba9cebe4c3491ab1f297fdf98bbf1eb1cc3bf4607a4b5d385299aaf08027" } }, - "generatedAt": "2026-05-08T03:22:29.460Z" + "generatedAt": "2026-05-07T23:14:09.820Z" }