Skip to content

ci: every deployed version names its source commit, registry commit, trigger and run - #43

Merged
kurtseifried merged 1 commit into
mainfrom
ci/stamp-deploy-provenance
Oct 1, 2026
Merged

kurtseifried merged 1 commit into
mainfrom
ci/stamp-deploy-provenance

Conversation

@kurtseifried

Copy link
Copy Markdown
Contributor

Cloudflare listed every SecID version as "Manually deployed — Wrangler by
Unknown" with no tag or message, so the version list could not say which
commit was live. wrangler deploy now gets --tag and
--message "SecID-Service + registry (, run
)" (<= 89 chars). Only trusted values are interpolated, via env vars.
"Unknown" is the token's owner — an account token has none — so identity
lives in the message. npm run deploy (break-glass) stamps the same, plus
"break-glass by " and +dirty for an uncommitted tree. README
says how to read it.

…trigger and run

Cloudflare listed every SecID version as "Manually deployed — Wrangler by
Unknown" with no tag or message, so the version list could not say which
commit was live. wrangler deploy now gets --tag <service sha12> and
--message "SecID-Service <sha12> + registry <spec sha12> (<event>, run
<id>)" (<= 89 chars). Only trusted values are interpolated, via env vars.
"Unknown" is the token's owner — an account token has none — so identity
lives in the message. npm run deploy (break-glass) stamps the same, plus
"break-glass by <git user>" and +dirty for an uncommitted tree. README
says how to read it.
@kurtseifried
kurtseifried merged commit a80dd9a into main Oct 1, 2026
1 check passed
@kurtseifried
kurtseifried deleted the ci/stamp-deploy-provenance branch October 1, 2026 16:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant