> you do not need to review each change to cut a release branch
This seems really tricky.
If I create a new release ref that points to the tip of main, I must ensure that the tip of main complies with all requirements that govern the release ref.
It's normal for the requirements to be different between those contexts.
Moving fully reviewed content from one context to another still requires review, except for well-understood automatic processes
This makes sense to me. I'm not sure the example expresses this though.
TomHennen
commented
1 week ago
This seems really tricky. If I create a new release ref that points to the tip of main, I must ensure that the tip of main complies with all requirements that govern the release ref. It's normal for the requirements to be different between those contexts.
This makes sense to me. I'm not sure the example expresses this though.
_Originally posted by @zachariahcox in https://github.com/slsa-framework/slsa/pull/1037#discussion_r1588442531_