Description
In order to have repeatable builds, the git repository commits used to build the artifacts should be uploaded along with the release as well.
There are two cases:
- If a
qmk_firmware submodule is used, this seems easy enough to do.
- If no submodule is used, there should be a way of determining the commit that it used to build (and a way to specify it with
qmk compile, I suppose).
This could be extended into providing an SBOM for the release, but just the git commit is a good starting point.
Description
In order to have repeatable builds, the git repository commits used to build the artifacts should be uploaded along with the release as well.
There are two cases:
qmk_firmwaresubmodule is used, this seems easy enough to do.qmk compile, I suppose).This could be extended into providing an SBOM for the release, but just the git commit is a good starting point.