mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: serialize DEV CD apply

Browse Source
This commit is contained in:
Code Queue Review
2026-05-23 09:08:31 +00:00
parent dc031e0640
commit 24ccabbb89
15 changed files with 2140 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/dev-deploy-apply.md
+18 -7
View File
@@ -1,9 +1,11 @@
# HWLAB DEV Deploy Apply
This document records the DEV-only apply/preflight path for
This document records the DEV-only apply/preflight backend for
`pikasTech/HWLAB#33` and the apply-plan/report path for
`pikasTech/HWLAB#50`. It targets only the D601 `hwlab-dev` namespace and must
not be used for PROD.
`pikasTech/HWLAB#50`. Real apply side effects are normally entered through
`scripts/dev-cd-apply.mjs`, which sets the transaction environment and
serializes publish/apply/verify with the DEV CD Lease lock. The apply backend
targets only the D601 `hwlab-dev` namespace and must not be used for PROD.
## Scope
@@ -56,13 +58,22 @@ node tools/hwlab-cli/bin/hwlab-cli.mjs test e2e --env dev --mvp --dry-run
```
Only after CI publish evidence and executor prerequisites exist, a real DEV
apply requires explicit non-production confirmation:
CD transaction is:
```sh
node scripts/dev-cd-apply.mjs --apply --confirm-dev --confirmed-non-production --write-report
```
The underlying apply backend still requires explicit non-production
confirmation and a transaction environment:
```sh
node scripts/dev-deploy-apply.mjs --apply --confirm-dev --confirmed-non-production --write-report
```
The script refuses PROD flags, secret-read flags, heavyweight e2e flags, and
Direct `--apply` without `HWLAB_CD_TRANSACTION_ID` is rejected with
`cd-transaction-required`; this is a bypass guard, not a second lock. The
script refuses PROD flags, secret-read flags, heavyweight e2e flags, and
force-push flags. It also refuses to apply if the DEV artifact catalog still
contains skeleton-only unpublished images.
@@ -176,7 +187,7 @@ node scripts/dev-deploy-apply.mjs --dry-run --write-report
node scripts/validate-dev-gate-report.mjs
```
Only after that approval may the DEV-only apply command be used.
Only after that approval may the DEV CD transaction command be used.
## Cloud Web Manual DEV Rollout
@@ -202,7 +213,7 @@ freshness gates.
```sh
node web/hwlab-cloud-web/scripts/check.mjs
node web/hwlab-cloud-web/scripts/build.mjs
node scripts/dev-artifact-publish.mjs --publish --services hwlab-cloud-web --report reports/dev-gate/dev-artifacts-hwlab-cloud-web-<tag>.json
node scripts/dev-cd-apply.mjs --apply --confirm-dev --confirmed-non-production --write-report
```
Probe the image locally before touching k3s: