action/image-build
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Exclude build proxy artifacts from native provider module archives
Private module tooling / contract (pull_request) Failing after 4s
Details

Browse Source 
Authored-By: Codex (GPT-6) <noreply@openai.com>
This commit is contained in:
Evelyn Chen
2026-09-07 15:08:18 +00:00
parent 52c9456208
commit 23729de1bb
4 changed files with 65 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5
View File
@@ -35,6 +35,11 @@ client once, then run the generated command with `-write` to copy unchanged
generator itself enforces offline resolution and a local toolchain. It preserves
the complete original archives, including any licenses and notices. Normal Go
downloads still validate their content against the consumer's `go.sum`.
The generated proxy directory has an exact build-only nested `go.mod` marker.
Native Go module packaging excludes that directory from provider releases, so
downstream consumers never recursively bundle another provider's build inputs.
The checker requires the marker, and a native local-Git archive test proves the
exclusion without permitting Git network protocols.
Consumer resolution uses `GONOPROXY=none`, `GONOSUMDB=code.fritzlab.net`,
`GOFLAGS=-mod=readonly`, `GOTOOLCHAIN=local`, and