Skip to content

feat(build): pin Gradle distribution with SHA256 checksum - #603

Merged
transitrix merged 2 commits into
mainfrom
transitrix-studio/470-gradle-wrapper-integrity
Aug 30, 2026
Merged

feat(build): pin Gradle distribution with SHA256 checksum#603
transitrix merged 2 commits into
mainfrom
transitrix-studio/470-gradle-wrapper-integrity

Conversation

@transitrix

@transitrix transitrix commented Aug 30, 2026

Copy link
Copy Markdown
Owner

Summary

Adds distributionSha256Sum to gradle-wrapper.properties to cryptographically verify the Gradle distribution.

Adds CI workflow that verifies:

  • Download host remains pinned to services.gradle.org (prevents supply-chain redirection)
  • SHA256 checksum is present and valid
  • Check fails closed on any missing or invalid configuration

Verification

  • Gradle 9.7.1 SHA256: acd53f1edaf02f1a8ff99879f8a34b302661a057d9b063ae9e35b552f804d20a
  • Wrapper properties now carry both distributionUrl and distributionSha256Sum
  • CI check validates configuration on every wrapper properties change
  • Legitimate version bumps that maintain host/shape can still land within grant bounds

@transitrix
feat(build): pin Gradle distribution with SHA256 checksum (transitrix…
de7b755 
…-hq#470)

Add distributionSha256Sum to gradle-wrapper.properties to cryptographically verify
the Gradle distribution matches the intended version. This satisfies REQUIREMENT-BUILD-INPUT-INTEGRITY-1
and allows the Gradle grant to rest on code rather than prose.
@transitrix
chore(ci): add Gradle wrapper integrity check workflow (transitrix-hq…
b3eee00 
…#470)

Verifies that Gradle wrapper configuration maintains:
- Download host pinning to services.gradle.org (prevents supply chain redirection)
- SHA256 checksum presence and validity (ensures distribution integrity)

Fails closed on any missing or invalid configuration.
@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown

📊 Metrics Regression Report

✅ All metrics within tolerance

Summary

  • Diagrams tested: 9
  • Successful: 9
  • Failed: 0
  • Violations: 0

Details

ai-expense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 1868 1868 0.00 (0.0%) ✓
waypointDensity 2.6 2.6 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.48125 0.48125 0.00 ✓
portViolations 0 0 0.00 ✓

feature-release.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 13 13 0.00 ✓
edgeLength 3428 3428 0.00 (0.0%) ✓
waypointDensity 3 3 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5500909090909091 0.5500909090909091 0.00 ✓
portViolations 0 0 0.00 ✓

large-cyclic-workflow.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 2 2 0.00 ✓
bends 28 28 0.00 ✓
edgeLength 7479 7479 0.00 (0.0%) ✓
waypointDensity 3.12 3.12 0.00 (0.0%) ✓
spineDeviation 66 66 0.00 ✓
emptyArea 0.793134974640294 0.793134974640294 0.00 ✓
portViolations 1 1 0.00 ✓

order-fulfillment.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 2 2 0.00 ✓
edgeLength 728 728 0.00 (0.0%) ✓
waypointDensity 2.3333333333333335 2.3333333333333335 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5622894736842106 0.5622894736842106 0.00 ✓
portViolations 0 0 0.00 ✓

parallel-tracks.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 2104 2104 0.00 (0.0%) ✓
waypointDensity 2.6666666666666665 2.6666666666666665 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.6834468042259194 0.6834468042259194 0.00 ✓
portViolations 0 0 0.00 ✓

simple-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 8 8 0.00 ✓
edgeLength 1450 1450 0.00 (0.0%) ✓
waypointDensity 3.142857142857143 3.142857142857143 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.7764882411250177 0.7764882411250177 0.00 ✓
portViolations 0 0 0.00 ✓

simple-linear.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 0 0 0.00 ✓
edgeLength 440 440 0.00 (0.0%) ✓
waypointDensity 2 2 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5258771929824562 0.5258771929824562 0.00 ✓
portViolations 0 0 0.00 ✓

small-dense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 14 14 0.00 ✓
edgeLength 2066 2066 0.00 (0.0%) ✓
waypointDensity 3.272727272727273 3.272727272727273 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.8091206777597997 0.8091206777597997 0.00 ✓
portViolations 0 0 0.00 ✓

xlarge-stress-test.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 1 +1.00 ✓
bends 62 64 +2.00 ✓
edgeLength 11526 11674 +148.00 (1.3%) ✓
waypointDensity 3.1481481481481484 3.185185185185185 +0.04 (1.2%) ✓
spineDeviation 132 132 0.00 ✓
emptyArea 0.8201716840253008 0.8201716840253008 0.00 ✓
portViolations 0 0 0.00 ✓

@transitrix
transitrix merged commit 37643a6 into main Aug 30, 2026
9 checks passed
@transitrix
transitrix deleted the transitrix-studio/470-gradle-wrapper-integrity branch August 30, 2026 19:02
transitrix added a commit that referenced this pull request Aug 31, 2026
@transitrix
chore(release): prepare 3.6.0 (#605)
c8f3987 
Fold accumulated changelog fragments into CHANGELOG.md, restore two
entries dropped by a bad merge in #603, and bump versions:
extension/root 3.5.0 -> 3.6.0, @transitrix/diagrams 1.11.0 -> 1.12.0,
@transitrix/cli 2.7.0 -> 2.8.0.

Signed-off-by: transitrix <automation@transitrix.com>
@transitrix transitrix mentioned this pull request Aug 31, 2026
Merged
vkgeorgia pushed a commit that referenced this pull request Aug 31, 2026
@transitrix @claude
fix(preview): restore canon root resolver for normative layout (#608)
c157f92 
Restores findCanonRootPath and findModelRootPath that were accidentally
deleted in PR #603. The resolver searches for transitrix.yaml to locate
the model root, then resolves canon/ from there (normative layout), with
fallback to legacy basename-canon walk.

Includes the two unit tests that verify both normative and legacy layouts
resolve correctly. Deleting the tests without deleting the resolver would
allow a future merge to drop the walker again silently.

Fixes the regression in 3.6.0 where the fix was described in release
notes but missing from the published VSIX.

Fixes transitrix-hq#485.

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@transitrix