From 59fe1a01758448a04f036982cec739cc91e27501 Mon Sep 17 00:00:00 2001 From: garrytan Date: Sat, 31 Oct 2026 15:44:44 +0000 Subject: [PATCH] docs(cso): source tags must name an exact release Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- docs/cso-release-qualification.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/cso-release-qualification.md b/docs/cso-release-qualification.md index ee6d60a00..c37d7570f 100644 --- a/docs/cso-release-qualification.md +++ b/docs/cso-release-qualification.md @@ -145,8 +145,11 @@ archive bytes, not a verified response URL. Image publication starts with the committed [`build-inputs.json`](../lib/cso/images/build-inputs.json). Its reviewed revision pins distinct native manifests for every stack and the SBOM generator. Each -profile records the inspected source tag and immutable index for provenance, -then `baseImages` keyed by `linux/amd64` and `linux/arm64`; Python additionally +profile records the inspected source tag and immutable index for provenance. +The source tag must name an exact release (`..`, or +`.` for PostgreSQL); a floating major or minor tag, `latest` or +another alias fails matrix generation with `FLOATING__SOURCE`. Each profile then records +`baseImages` keyed by `linux/amd64` and `linux/arm64`; Python additionally records native uv manifests. CI fails if a source tag no longer resolves to the reviewed index, a platform manifest is absent from that index, its image configuration names another architecture, or an executable reports a different