Why
SpecGit delivery record updates currently restart expensive product verification although the product content has not changed. The user requested avoiding full CI for these metadata-only updates while retaining meaningful verification for actual changes and releases.
Scope
The Typecheck, Unit Tests (linux), and E2E jobs in this repository. Only the root .specgit.yaml delivery record is excluded from the verified content fingerprint. Workflow, policy, dependency, documentation, and source changes remain verification inputs.
Approach
Record successful verification for each job and platform using an exact content fingerprint in an immutable Actions artifact. Cache only a locator; verify the source job, attempt, workflow, runner label, UTC date, platform-owned source SHA, and artifact provenance before reusing it. Live PR head fields are never historical evidence. Reuse evidence only when that fingerprint matches; cache misses, manual runs, and changed verification inputs execute the complete checks. Keep the existing required check names and document evidence reuse in the job summary. Do not modify required checks or the release workflow.
Acceptance
- A record-only change preserves the verification fingerprint, including added or removed records.
- Product, workflow, policy, executable mode, and submodule changes invalidate it.
- Only a job whose verification steps have all succeeded can save reusable evidence; a miss executes the full job.
- Manual verification always runs fully, and current-head required checks still report results.
- Focused regression tests and current-head CI pass.
Why
SpecGit delivery record updates currently restart expensive product verification although the product content has not changed. The user requested avoiding full CI for these metadata-only updates while retaining meaningful verification for actual changes and releases.
Scope
The Typecheck, Unit Tests (linux), and E2E jobs in this repository. Only the root
.specgit.yamldelivery record is excluded from the verified content fingerprint. Workflow, policy, dependency, documentation, and source changes remain verification inputs.Approach
Record successful verification for each job and platform using an exact content fingerprint in an immutable Actions artifact. Cache only a locator; verify the source job, attempt, workflow, runner label, UTC date, platform-owned source SHA, and artifact provenance before reusing it. Live PR head fields are never historical evidence. Reuse evidence only when that fingerprint matches; cache misses, manual runs, and changed verification inputs execute the complete checks. Keep the existing required check names and document evidence reuse in the job summary. Do not modify required checks or the release workflow.
Acceptance