Under the hood
No documentation found
Artifact publishing can now verify a source file's bytes against a given SHA-256 hash before publishing
What
The artifact-publish tool now supports an internal publishSourceSha256 field. When present, it checks the source file's actual bytes against that hash and throws a source_unverified error if they don't match. This applies both to sources pinned by network location and to on-disk files; for on-disk files, a symlink as the final path element also now forces source_unverified.
Why
This prevents publishing an artifact whose source content doesn't match what was expected, including cases where a symlink might otherwise substitute unexpected content.