A communityA filename or a workflow name is not enough to identify a native engine artifact. Trace the artifact back to the source and target that produced it.
Read the matrix before the label
The checked Nest engine workflow is build-and-upload-engine-variants.yaml at revision 0f521ed9d85cf4f03bd5cd68a32b21528d1a5ace. It defines web, Android, Linux, macOS and iOS-related jobs and uses matrix configuration names. These source entries describe intended jobs, not a verified list of currently downloadable or supported releases.
Follow the assembly step, target configuration and upload action. Keep the workflow revision distinct from the assembled framework revision and the identifier used for an engine artifact. Similar-looking hashes can have different roles in the pipeline.
Artifact provenance record
Workflow source revision:
Run / job / matrix entry:
Assembled framework revision:
Engine artifact identifier:
Target OS / architecture / build mode:
Artifact location and retrieval date:
Published checksum or independently computed digest:
Who published it / expected destination:
Target build and runtime evidence:
Unverified fields:Compare like with like
Match the requested operating system, architecture and mode to the artifact you are examining. A simulator-related entry is not a substitute for physical-device release evidence. A framework test result does not prove that every native artifact exists or is compatible with an app.
When you inspect an actual published file, retain its digest and provenance. A checksum can detect a different file, but by itself does not establish a trustworthy publisher. Keep the origin and source identity in the same record.
An incomplete record stays incomplete
In a synthetic review, an artifact’s target and digest are known, but the build run and assembled source revision are missing. The reviewer can identify that file but cannot yet support an end-to-end provenance claim. They request the missing run evidence before adoption.
This walkthrough does not download binaries, access a storage bucket or execute Nest’s build jobs. Use the actual source and authorized artifact publisher for those operations, and test the application’s real target before accepting a custom engine.
Identify the matrix target → Trace source identities → Match the published artifact → Verify the actual target app.