From cf14836d48b0b4aaa67f99433f4fba3585bcd2bb Mon Sep 17 00:00:00 2001 From: KyuubiYoru Date: Thu, 16 Jul 2026 16:04:25 +0200 Subject: [PATCH] fix(operations): require clean candidate provenance (#18) --- scripts/run-capacity-gate.sh | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/scripts/run-capacity-gate.sh b/scripts/run-capacity-gate.sh index 448638c..d679d3d 100755 --- a/scripts/run-capacity-gate.sh +++ b/scripts/run-capacity-gate.sh @@ -24,6 +24,19 @@ if [[ -n "$CPUSET" ]]; then fi cd "$ROOT" +export RENDEZVOUS_EVIDENCE_COMMIT="$(git rev-parse HEAD)" +if [[ -n "$(git status --porcelain)" ]]; then + export RENDEZVOUS_EVIDENCE_TREE_STATE=dirty +else + export RENDEZVOUS_EVIDENCE_TREE_STATE=clean +fi +if [[ "$PROFILE" == candidate && "$RENDEZVOUS_EVIDENCE_TREE_STATE" != clean ]]; then + printf 'Candidate evidence requires a clean source tree.\n' >&2 + exit 2 +fi +export RENDEZVOUS_EVIDENCE_CPUSET="${CPUSET:-unrestricted}" +export RENDEZVOUS_EVIDENCE_COMMAND="RENDEZVOUS_CAPACITY_PROFILE=$PROFILE RENDEZVOUS_CAPACITY_CPUSET=${CPUSET:-unrestricted} ./scripts/run-capacity-gate.sh" + dotnet restore "$ROOT/Rendezvous.slnx" --locked-mode dotnet build "$ROOT/Rendezvous.slnx" --configuration Release --no-restore @@ -36,16 +49,6 @@ arguments=( dotnet run --project "$PROJECT" --configuration Release --no-build -- --profile "$PROFILE" --output "$OUTPUT" ) -export RENDEZVOUS_EVIDENCE_COMMIT="${RENDEZVOUS_EVIDENCE_COMMIT:-$(git rev-parse HEAD)}" -if [[ -z "${RENDEZVOUS_EVIDENCE_TREE_STATE:-}" ]]; then - if [[ -n "$(git status --porcelain)" ]]; then - export RENDEZVOUS_EVIDENCE_TREE_STATE=dirty - else - export RENDEZVOUS_EVIDENCE_TREE_STATE=clean - fi -fi -export RENDEZVOUS_EVIDENCE_CPUSET="${CPUSET:-unrestricted}" -export RENDEZVOUS_EVIDENCE_COMMAND="RENDEZVOUS_CAPACITY_PROFILE=$PROFILE RENDEZVOUS_CAPACITY_CPUSET=${CPUSET:-unrestricted} ./scripts/run-capacity-gate.sh" if [[ -n "$CPUSET" ]]; then taskset -c "$CPUSET" "${arguments[@]}" else