Store *CRAFT package commit in artefact metadata
Metadata
Current evaluation
CRAFT inspectors still expose the YAML version instead of the checked-out Git commit; this valid provenance enhancement remains open, with a dedicated metadata field as an unsettled alternative.
Suggested action: keep open
Reason: @sergiusens engaged with the terminology, another commenter gave a +1, and the author subsequently clarified that sources should expose a commit. The current Sourcecraft and Snapcraft inspectors still set metadata.version from their YAML, confirming the gap; maintainers mainly need to settle whether the commit replaces version or uses a dedicated field.
Evaluated by: mr-cal-bot
Impact:
46
Quick Win:
17
Complexity:
48
Confidence:
91
Actionability:
72
Issue body
### What needs to get done
For the artefact metadata of CRAFT packages, we currently use the `version` from the *craft.yaml file in the git repo commit that was pulled in, and store that in artefact `metadata.version`. Instead of doing this, store the commit hash that was pulled in, and store this in the artefact `metadata.version`, similar format to `application/x.canonical.snap-package` (but not using the revision this time).
### Why it needs to get done
It's useful for machine-consumers of the Fetch Service Metadata to be able to know what commit of the CRAFT package was pulled into a build, so that they may ie. query the Store for info on the CRAFT package revision. Currently, getting the CRAFT package commit is only obtainable from the "craft" "inspector annotations (looking at the "checkout" commit) e.g.
```
"craft.sourcecraft": {
"opinion": "Approved",
"reason": "sourcecraft repository found",
"annotations": {
"checkout": "0ac1768502a1966167a289ab046645d547b72461"
}
```
However, annotations are meant for human-consumption, so machines should avoid parsing these, hence the need for this change.
It may also be worth considering extending the artifact metadata format in general to include an additional "revision" or "commit" field or similar, in order to allow for this info to exist alongside the "version" field, and have the "version" field match the version in the *craft YAML.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
46
Quick Win:
17
Complexity:
48
Confidence:
91
Actionability:
72
|
keep open | CRAFT inspectors still expose the YAML version instead of the checked-out Git commit; this valid provenance enhancement remains open, with a dedicated metadata field as an unsettled alternative. | |
| stealth/space-bunny-alpha |
Impact:
45
Quick Win:
15
Complexity:
45
Confidence:
87
Actionability:
60
|
needs triage | Open request to expose the exact CRAFT repository commit in artifact metadata. Current inspectors expose the YAML version and fetched Git ref separately; discussion favors a commit field over revision. | |
| stealth/space-bunny-alpha |
Impact:
46
Quick Win:
18
Complexity:
39
Confidence:
76
Actionability:
63
|
needs triage | CRAFT artefact metadata stores the package version from craft.yaml, not the checked-out source commit, limiting machine-readable provenance. The proposal remains open and needs maintainer triage. | |
| qwen/qwen3.6-35b-a3b |
Impact:
50
Quick Win:
25
Staleness:
75
Complexity:
50
Confidence:
60
Support Request:
25
|
keep open | Feature request to store CRAFT package commit hash in artefact metadata instead of version from craft.yaml. Discussed with Jira ticket CRAFT-3964 created, but inactive for 390 days. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
No related issues found above the similarity threshold.