ci: wire Linux evidence drift into release gate

[SSobol77]

Summary

Wire the Linux official distro evidence drift audit into the canonical ECLI release gate.

This PR makes official distro evidence drift release-visible and release-blocking through make validate-gate2.

What changed

Added the canonical Make target:

make validate-official-evidence-drift

The target runs:

uv run python scripts/f4_linter_linux_provisioning.py --check-official-evidence-drift

The target is wired into:

validate-gate2

The Python provisioning script remains the single source of truth for official evidence drift detection.

Failure behavior

The Make target does not mask exit codes.

If the Python gate exits 2 because official distro evidence drift is detected:

• make validate-official-evidence-drift fails;
• make validate-gate2 stops;
• release validation is blocked.

Tests

Added coverage proving:

• validate-gate2 invokes the official evidence drift gate;
• the Make target delegates to the existing Python CLI;
• the clean evidence state passes;
• exit code 2 propagates as a failing release gate;
• the gate does not invoke provisioning or evidence generation;
• release documentation references the new gate.

Documentation

Updated:

• docs/release/release-checklist.md
• docs/release/artifact-contract.md
• docs/release/packaging-flows.md

Preserved invariants

This PR does not:

• promote additional distro mappings;
• change the six verified Debian evidence records;
• promote Docker helper records;
• promote non-Debian mappings;
• change OS_PACKAGE_NAMES;
• change package or executable names;
• change official evidence URLs;
• add versions or checksums;
• invoke package managers;
• perform network operations;
• generate or commit release artifacts;
• modify UI, runtime, diagnostics, providers, parsers, TextMate, or themes.

Validation

Passed:

uv run ruff check src tests scripts
uv run ruff format --check src tests scripts
uv run python scripts/check_runtime_imports.py
uv run pytest -q tests/packaging/test_f4_linter_linux_provisioning.py
uv run pytest -q tests/packaging
uv run pytest -q tests/docs
uv run python scripts/f4_linter_linux_provisioning.py --check-official-evidence-drift
git diff --check

Observed:

tests/packaging/test_f4_linter_linux_provisioning.py: 128 passed
tests/packaging: 501 passed
tests/docs: 18 passed
PASS: Linux official distro evidence drift audit clean

Existing unrelated validation failure

The new official evidence drift gate runs and passes inside:

make validate-gate2

The target later fails in the pre-existing PyPI artifact validation because the local ignored release tree does not contain:

releases/0.2.3/ecli_editor-0.2.3-py3-none-any.whl.sha256

The local release tree stores checksum files under .checksums/, while the existing per-artifact Make target expects a top-level sidecar.

This unrelated checksum-layout behavior is intentionally not modified in PR #141.

Summary by CodeRabbit

• New Features

  • Added an official evidence drift validation check to the release validation workflow.
  • Validation now reports clear success or release-blocking drift results.

• Documentation

  • Updated release documentation and checklists with the new validation step, command, and expected outcomes.

• Tests

  • Added coverage for successful validation, failure propagation, command execution, and documentation references.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 506326da-992b-4600-a8c6-24d5b0d4cf43

📥 Commits

Reviewing files that changed from the base of the PR and between 1110aef and 9588c2e.

📒 Files selected for processing (5)

• Makefile
• docs/release/artifact-contract.md
• docs/release/packaging-flows.md
• docs/release/release-checklist.md
• tests/packaging/test_f4_linter_linux_provisioning.py

---

📝 Walkthrough

Walkthrough

Adds an official Linux distro evidence-drift validation target, includes it in Gate 2, documents its release-gating behavior, and tests successful execution, failure propagation, and documentation coverage.

Changes

Official evidence drift validation

Layer / File(s)	Summary
Add and wire the drift validation target Makefile	Adds validate-official-evidence-drift, exposes it in help output, and includes it in validate-gate2.
Document release-gate behavior docs/release/artifact-contract.md, docs/release/packaging-flows.md, docs/release/release-checklist.md	Documents the verifier command, read-only behavior, expected output, and release-blocking exit code.
Test gate execution and propagation tests/packaging/test_f4_linter_linux_provisioning.py	Tests target wiring, successful audits, Gate 2 failure propagation, command invocation, and documentation references.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• SSobol77/ecli#127: Adds the same official evidence-drift target, tests, and documentation around the provisioning linter.
• SSobol77/ecli#136: Changes the official evidence registry evaluated by this drift-check gate.
• SSobol77/ecli#138: Refactors the evidence registry used by the drift validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: wiring Linux evidence drift checks into the release gate.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/f4-linux-official-evidence-release-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud