fix: keep deploy manifest human-authored
This commit is contained in:
Codex
+6
-5
@@ -61,8 +61,8 @@ Desired-state commit/image convergence review:
|
||||
|
||||
```sh
|
||||
node scripts/deploy-desired-state-plan.mjs --plan --pretty
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --pretty
|
||||
node scripts/deploy-desired-state-plan.mjs --check
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/G14 --pretty
|
||||
node scripts/deploy-desired-state-plan.mjs --target-tag <tag> --pretty
|
||||
node scripts/deploy-desired-state-plan.mjs --promotion-commit <sha> --check
|
||||
```
|
||||
@@ -80,9 +80,10 @@ The plan blocks if generated artifact identity leaks back into `deploy.json`,
|
||||
or if `hwlab-cloud-api` loses the Code Agent provider Secret ref
|
||||
`hwlab-code-agent-provider/openai-api-key`, the `OPENAI_API_KEY` env name, or
|
||||
the DEV egress proxy base-url env. Promotion updates must refresh only the
|
||||
workspace catalog from a publish report before render; Tekton writes the
|
||||
refreshed catalog to `G14-gitops`, not back to the source branch. Report files
|
||||
are contextual evidence only and must not override human-authored source truth.
|
||||
workspace catalog from a publish report before render; Tekton writes that
|
||||
catalog to `G14-gitops`, not back to the source branch. Human operators should
|
||||
not run catalog refresh as a source update. Report files are contextual evidence
|
||||
only and must not override human-authored source truth.
|
||||
|
||||
This is source/dry-run support only. It does not prove a registry image exists,
|
||||
does not build, pull, push, apply, restart, or touch PROD, and must not be used
|
||||
|
||||
+28
-30
@@ -39,7 +39,7 @@ metadata, then be copied into the catalog by the refresh command below.
|
||||
| `deploy/deploy.json` | Human-authored DEV runtime config such as service topology, env, health, profile, replicas, and endpoints. |
|
||||
| `scripts/g14-gitops-render.mjs` | Declares the Tekton primitive CI tasks and minimal guardrails that generate the G14 CI/CD control plane. |
|
||||
| `scripts/deploy-desired-state-plan.mjs` | Read-only planner/checker for catalog artifact identity, generated identity leakage into deploy config, and deploy/runtime config contracts. |
|
||||
| `scripts/refresh-artifact-catalog.mjs` | Refreshes source/artifact commit tags and records either blocked `not_published` state or proven publish digests. |
|
||||
| `scripts/refresh-artifact-catalog.mjs` | Previews artifact catalog identity by default; only G14 Tekton promotion uses `--write` to update `deploy/artifact-catalog.dev.json` before committing generated state to `G14-gitops`. |
|
||||
| `scripts/validate-artifact-catalog.mjs` | Local static validator for the catalog and deploy manifest skeleton. |
|
||||
| `scripts/preflight-dev-base-image.mjs` | Local DEV builder base-image preflight for future artifact publish. |
|
||||
| `docs/dev-base-image-preflight.md` | Operator contract for interpreting preflight readiness and blockers. |
|
||||
@@ -76,8 +76,8 @@ Use the read-only planner before refreshing or reviewing deploy desired-state:
|
||||
|
||||
```sh
|
||||
node scripts/deploy-desired-state-plan.mjs --plan --pretty
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --pretty
|
||||
node scripts/deploy-desired-state-plan.mjs --check
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/G14 --pretty
|
||||
node scripts/deploy-desired-state-plan.mjs --target-tag <tag> --pretty
|
||||
node scripts/deploy-desired-state-plan.mjs --promotion-commit <sha> --check
|
||||
```
|
||||
@@ -91,11 +91,10 @@ render because render overwrites them from the catalog.
|
||||
|
||||
`--check` exits non-zero when the source files are missing or invalid, generated
|
||||
artifact identity leaks into `deploy.json`, an explicit target tag is invalid or
|
||||
mutable, or catalog artifact identity does not match the requested target. A uniform older
|
||||
state under `--target-ref` is only allowed in read-only plan mode; with
|
||||
`--target-ref origin/main --check` it is a blocker because applying it would keep
|
||||
DEV pinned to stale artifacts. The optional report snapshot is contextual
|
||||
evidence only and is not an authoritative desired-state source.
|
||||
mutable, or catalog artifact identity does not match the requested target. The
|
||||
source branch catalog is only a seed contract; published artifact identity is
|
||||
stored on `G14-gitops`. The optional report snapshot is contextual evidence only
|
||||
and is not an authoritative desired-state source.
|
||||
|
||||
For PR review or CI/CD promotion handoff, use `--promotion-commit <sha>
|
||||
--check`. That mode is stricter than a `--target-ref` plan: the catalog
|
||||
@@ -108,42 +107,40 @@ M3 DEV-LIVE. Only real DEV observation of
|
||||
`res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` with operation,
|
||||
trace, audit, and evidence records can be called M3 DEV-LIVE.
|
||||
|
||||
## Refresh Workflow
|
||||
## Refresh Boundary
|
||||
|
||||
When the source commit changes and no publish report proves digests, refresh the
|
||||
catalog in blocked mode:
|
||||
Human source work must not refresh artifact identity into the source branch. To
|
||||
preview what a blocked catalog would look like, use read-only mode:
|
||||
|
||||
```sh
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --blocked --no-write
|
||||
node scripts/deploy-desired-state-plan.mjs --check
|
||||
```
|
||||
|
||||
This updates `deploy/deploy.json`, `deploy/artifact-catalog.dev.json`, and
|
||||
`deploy/k8s/base/workloads.yaml` to the selected commit tag. It keeps
|
||||
`artifactState: "contract-skeleton"`, `ciPublished=false`,
|
||||
`registryVerified=false`, and every service digest as `not_published`.
|
||||
This prints the planned catalog state and does not modify any repository file.
|
||||
Blocked skeleton refresh is intentionally preview-only.
|
||||
|
||||
After a successful DEV artifact publish, record digests only from the publish
|
||||
report:
|
||||
After a successful DEV artifact publish, only the G14 Tekton promotion path may
|
||||
record digests from the publish report:
|
||||
|
||||
```sh
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report /tmp/hwlab-dev-gate/dev-artifacts.json
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref <source-sha> --publish-report /workspace/source/dev-artifacts.json --write
|
||||
```
|
||||
|
||||
The publish-report mode refuses to update the catalog unless the report says
|
||||
`artifactPublish.status="published"`, covers every frozen service in the v2
|
||||
publish plan, matches the target source commit, and contains a valid `sha256`
|
||||
digest for each required service. Disabled services remain `skeleton-only` with
|
||||
`digest: "not_published"`.
|
||||
`digest: "not_published"`. The written catalog is committed only to
|
||||
`G14-gitops`; `deploy/deploy.json` remains human-authored source truth.
|
||||
|
||||
## Relationship To `deploy/deploy.json`
|
||||
|
||||
`deploy/deploy.json` remains the deploy manifest skeleton. The artifact catalog
|
||||
does not replace it and must not be consumed as proof that a release was built.
|
||||
The catalog explains the artifact identity that `deploy/deploy.json` currently
|
||||
claims, then adds stricter DEV-only rules around commit pinning, image tags,
|
||||
health paths, forbidden profiles, and publish state.
|
||||
`deploy/deploy.json` remains the human-authored deploy manifest. The artifact
|
||||
catalog does not replace it and must not be consumed as proof that a release was
|
||||
built. GitOps render combines human config from `deploy.json` with generated
|
||||
artifact identity from the catalog; artifact identity must not be copied back
|
||||
into `deploy.json`.
|
||||
|
||||
If a future CI workflow publishes real images, it should update or generate a
|
||||
publish result that includes registry digests and provenance. That publish
|
||||
@@ -177,7 +174,7 @@ Run the local static validator:
|
||||
node --check scripts/deploy-desired-state-plan.mjs
|
||||
node --check scripts/src/deploy-desired-state-plan.mjs
|
||||
node --test scripts/deploy-desired-state-plan.test.mjs
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check
|
||||
node scripts/deploy-desired-state-plan.mjs --check
|
||||
node --check scripts/validate-artifact-catalog.mjs
|
||||
node --check scripts/refresh-artifact-catalog.mjs
|
||||
node --check scripts/preflight-dev-base-image.mjs
|
||||
@@ -185,7 +182,8 @@ node --check scripts/src/dev-base-image-preflight.mjs
|
||||
node scripts/validate-artifact-catalog.mjs
|
||||
```
|
||||
|
||||
The validator and refresh command read only local repository files and optional
|
||||
publish reports. The desired-state planner has the same read-only boundary.
|
||||
The validator and refresh command read local repository files and optional
|
||||
publish reports; refresh is read-only unless `--write` is explicitly supplied.
|
||||
The desired-state planner has the same read-only boundary.
|
||||
These commands do not contact a registry, read secrets, build images, push
|
||||
images, deploy to DEV, or deploy to PROD.
|
||||
|
||||
@@ -136,7 +136,7 @@ commit changed but publish is still blocked:
|
||||
|
||||
```sh
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --pretty
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked --no-write
|
||||
```
|
||||
|
||||
Only use the published refresh path after `/tmp/hwlab-dev-gate/dev-artifacts.json`
|
||||
@@ -144,7 +144,7 @@ proves every frozen service has a registry digest for that same source commit:
|
||||
|
||||
```sh
|
||||
node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --pretty
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report /tmp/hwlab-dev-gate/dev-artifacts.json
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report /tmp/hwlab-dev-gate/dev-artifacts.json --no-write
|
||||
```
|
||||
|
||||
Committed DEV artifact reports can prove required service digests only for the
|
||||
|
||||
@@ -69,9 +69,9 @@ HWLAB 是 monorepo，G14 CI/CD 加速必须按组件输入判断构建和滚动
|
||||
- 服务清单兼容顺序固定为：显式 `--services`、`deploy.services[]`、`deploy.k3s.serviceMappings[]`、`internal/protocol.SERVICE_IDS`。因此旧 `deploy/deploy.json` 形态和当前完整 `deploy.services[]` 形态都必须能被 planner 识别。
|
||||
- 组件边界固定由 `scripts/src/g14-ci-plan-lib.mjs` 的内建 service-path model 定义；如需新增或调整 `componentPaths`、`sharedPaths`、`runtimeDeps` 或 `buildSystemPaths`，直接修改 planner 库和对应测试，不再额外维护 repo-local commands/forbidden skeleton。
|
||||
- `scripts/g14-artifact-publish.mjs` 默认启用组件级 lazy build：先运行 planner，再只构建/推送 `affectedServices`，`reusedServices` 从 `deploy/artifact-catalog.dev.json` 复用已有 sha256 digest；如果 catalog 没有可验证 digest，planner 直接把该服务列为 affected 并重新发布，不能用旧 guard 阻塞，也不能退回 Docker 或 legacy full-build 路线。
|
||||
- `scripts/g14-artifact-publish.mjs` 的 publish report 必须携带 planner 的 per-service 元数据；`scripts/refresh-artifact-catalog.mjs` 只把生成的 `commitId`、`image`、`imageTag`、`digest`、`publishState` 和 component provenance 字段复制进当前 workspace 的 `deploy/artifact-catalog.dev.json`。Tekton promotion 只把刷新后的 catalog 写入 `G14-gitops`；`deploy/deploy.json` 是人写的 runtime config 真相源，不得被 promotion 回写镜像身份字段。
|
||||
- `scripts/g14-artifact-publish.mjs` 的 publish report 必须携带 planner 的 per-service 元数据；`scripts/refresh-artifact-catalog.mjs` 默认只预览，只有 G14 Tekton promotion 显式传 `--write` 时，才把生成的 `commitId`、`image`、`imageTag`、`digest`、`publishState` 和 component provenance 字段写进当前 workspace 的 `deploy/artifact-catalog.dev.json`，随后只提交到 `G14-gitops`。`deploy/deploy.json` 是人写的 runtime config 真相源，不得被 promotion、refresh 脚本或人工发布流程回写镜像身份字段。
|
||||
- `scripts/g14-gitops-render.mjs` 只支持混合 desired state：workload 的 container image、`HWLAB_IMAGE`、`HWLAB_IMAGE_TAG` 和 pod template `source-commit` 来自 `deploy/artifact-catalog.dev.json` 的 per-service artifact identity；普通 env、replica、healthPath、profile 等配置来自 `deploy/deploy.json`。全局 GitOps metadata 仍记录本次 source commit。`--legacy-source-images` 与 `HWLAB_G14_USE_DEPLOY_IMAGES=0` 已废弃，不得把所有 workload image 回退渲染为同一个 source commit tag。
|
||||
- G14 Tekton promotion 在推送 `G14-gitops` 前，必须用 publish report 刷新 workspace 内的 `deploy/artifact-catalog.dev.json`，然后把刷新后的 catalog 和 rendered GitOps desired state 一起提交到 `G14-gitops`。promotion 不得自动修改或推送 `G14` source branch，也不得自动修改 `deploy/deploy.json` 或 `deploy/k8s/base/workloads.yaml`，这样人写配置不会和 CI 生成身份反复冲突。
|
||||
- G14 Tekton promotion 在推送 `G14-gitops` 前，必须用 publish report 显式 `--write` 刷新 workspace 内的 `deploy/artifact-catalog.dev.json`，然后把刷新后的 catalog 和 rendered GitOps desired state 一起提交到 `G14-gitops`。promotion 不得自动修改或推送 `G14` source branch，也不得自动修改 `deploy/deploy.json` 或 `deploy/k8s/base/workloads.yaml`，这样人写配置不会和 CI 生成身份反复冲突。
|
||||
- Tekton 并发化只能以 planner 输出作为输入；每个 service 都有独立 TaskRun，changed service 启动 BuildKit，unchanged service 只写 reuse result 并复用 catalog digest，且不能改 pod template，避免无意义 rollout。没有完整 per-service desired state 证据时，必须修复 planner/catalog 证据，不能使用 `--full-build`、`--legacy-source-images`、DIND 或 Docker fallback 回退。
|
||||
|
||||
## 加速判定与当前瓶颈
|
||||
|
||||
+2
-2
@@ -18,7 +18,7 @@
|
||||
"deploy:contract:plan": "node scripts/deploy-contract-plan.mjs --pretty",
|
||||
"deploy:contract:check": "node scripts/deploy-contract-plan.mjs --check",
|
||||
"deploy:desired-state:plan": "node scripts/deploy-desired-state-plan.mjs --pretty",
|
||||
"deploy:desired-state:check": "node scripts/deploy-desired-state-plan.mjs --target-ref origin/main --check",
|
||||
"deploy:desired-state:check": "node scripts/deploy-desired-state-plan.mjs --check",
|
||||
"cli:health": "node tools/hwlab-cli/bin/hwlab-cli.mjs health",
|
||||
"cli:dry-run": "node tools/hwlab-cli/bin/hwlab-cli.mjs test e2e --env dev --mvp",
|
||||
"cli:projects": "node tools/hwlab-cli/bin/hwlab-cli.mjs project list",
|
||||
@@ -28,7 +28,7 @@
|
||||
"web:m3-control-panel": "node web/hwlab-cloud-web/scripts/m3-control-panel-guard.mjs",
|
||||
"web:check": "node web/hwlab-cloud-web/scripts/check.mjs && node --test web/hwlab-cloud-web/message-markdown.test.mjs web/hwlab-cloud-web/scripts/trace-scroll.test.mjs",
|
||||
"web:build": "node web/hwlab-cloud-web/scripts/build.mjs",
|
||||
"artifact-catalog:refresh-blocked": "node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked",
|
||||
"artifact-catalog:preview-blocked": "node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --blocked --no-write",
|
||||
"g14:gitops:render": "node scripts/g14-gitops-render.mjs",
|
||||
"cicd:jobs": "node tools/hwlab-cli/bin/hwlab-cli.mjs cicd jobs",
|
||||
"docs:validate:m3-rollout": "node scripts/validate-m3-rollout-runbook.mjs",
|
||||
|
||||
@@ -914,7 +914,7 @@ check_source_head before-render
|
||||
git config --global user.name "HWLAB G14 GitOps Bot"
|
||||
git config --global user.email "hwlab-g14-gitops-bot@users.noreply.github.com"
|
||||
if [ -s /workspace/source/dev-artifacts.json ]; then
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref "$(params.revision)" --publish-report /workspace/source/dev-artifacts.json
|
||||
node scripts/refresh-artifact-catalog.mjs --target-ref "$(params.revision)" --publish-report /workspace/source/dev-artifacts.json --write
|
||||
fi
|
||||
node scripts/g14-gitops-render.mjs --source-revision "$(params.revision)" --source-repo "$(params.git-url)" --source-branch "$(params.source-branch)" --gitops-branch "$(params.gitops-branch)" --registry-prefix "$(params.registry-prefix)" --use-deploy-images
|
||||
node scripts/g14-gitops-render.mjs --source-revision "$(params.revision)" --source-repo "$(params.git-url)" --source-branch "$(params.source-branch)" --gitops-branch "$(params.gitops-branch)" --registry-prefix "$(params.registry-prefix)" --use-deploy-images --check
|
||||
|
||||
@@ -29,7 +29,7 @@ function parseArgs(argv) {
|
||||
targetRef: "HEAD",
|
||||
publishReportPath: null,
|
||||
blocked: false,
|
||||
write: true
|
||||
write: false
|
||||
};
|
||||
|
||||
for (let index = 0; index < argv.length; index += 1) {
|
||||
@@ -40,6 +40,8 @@ function parseArgs(argv) {
|
||||
args.publishReportPath = readOption(argv, ++index, arg);
|
||||
} else if (arg === "--blocked") {
|
||||
args.blocked = true;
|
||||
} else if (arg === "--write") {
|
||||
args.write = true;
|
||||
} else if (arg === "--no-write") {
|
||||
args.write = false;
|
||||
} else if (arg === "--help" || arg === "-h") {
|
||||
@@ -52,6 +54,7 @@ function parseArgs(argv) {
|
||||
if (!args.help) {
|
||||
assert.notEqual(args.blocked && Boolean(args.publishReportPath), true, "--blocked and --publish-report are mutually exclusive");
|
||||
assert.ok(args.blocked || args.publishReportPath, `choose --blocked or --publish-report ${defaultPublishReportPath}`);
|
||||
assert.ok(!args.write || args.publishReportPath, "--write requires --publish-report; blocked skeleton refresh must stay preview-only");
|
||||
}
|
||||
|
||||
return args;
|
||||
@@ -67,13 +70,15 @@ function readOption(argv, index, name) {
|
||||
|
||||
function usage() {
|
||||
return [
|
||||
"usage: node scripts/refresh-artifact-catalog.mjs --target-ref REF (--blocked|--publish-report PATH) [--no-write]",
|
||||
"usage: node scripts/refresh-artifact-catalog.mjs --target-ref REF (--blocked|--publish-report PATH) [--write|--no-write]",
|
||||
"",
|
||||
"Refresh DEV deploy/catalog artifact identity without faking digest evidence.",
|
||||
"Preview or explicitly write DEV artifact catalog identity without faking digest evidence.",
|
||||
"Default mode is read-only. --write is reserved for G14 Tekton GitOps promotion and never writes deploy/deploy.json.",
|
||||
"",
|
||||
"examples:",
|
||||
" node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --blocked",
|
||||
` node scripts/refresh-artifact-catalog.mjs --target-ref origin/main --publish-report ${defaultPublishReportPath}`
|
||||
" node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --blocked --no-write",
|
||||
` node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --publish-report ${defaultPublishReportPath} --no-write`,
|
||||
` node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --publish-report ${defaultPublishReportPath} --write`
|
||||
].join("\n");
|
||||
}
|
||||
|
||||
|
||||
@@ -93,6 +93,63 @@ test("refresh accepts an absolute publish report path", async () => {
|
||||
assert.equal(payload.services[0].componentInputHash, `${String(1).padStart(64, "a")}`);
|
||||
});
|
||||
|
||||
test("refresh is read-only by default", async () => {
|
||||
const commitId = await git(["rev-parse", "HEAD"]);
|
||||
const shortCommitId = await git(["rev-parse", "--short=7", "HEAD"]);
|
||||
const tempDir = await mkdtemp(path.join(os.tmpdir(), "hwlab-refresh-default-readonly-"));
|
||||
const reportPath = path.join(tempDir, "dev-artifacts.json");
|
||||
await writeFile(reportPath, `${JSON.stringify({
|
||||
reportVersion: "v1",
|
||||
taskId: "g14-artifact-publish",
|
||||
commitId: shortCommitId,
|
||||
artifactPublish: {
|
||||
status: "published",
|
||||
mode: "publish",
|
||||
sourceCommitId: commitId,
|
||||
registryPrefix: "127.0.0.1:5000/hwlab",
|
||||
serviceCount: SERVICE_IDS.length,
|
||||
requiredServiceCount: SERVICE_IDS.length,
|
||||
disabledServiceCount: 0,
|
||||
publishedCount: SERVICE_IDS.length,
|
||||
publishPlan: {
|
||||
version: "v2",
|
||||
services: SERVICE_IDS.map((serviceId, index) => ({
|
||||
serviceId,
|
||||
required: true,
|
||||
digest: digestFor(index),
|
||||
image: `127.0.0.1:5000/hwlab/${serviceId}:${shortCommitId}`,
|
||||
imageTag: shortCommitId
|
||||
}))
|
||||
},
|
||||
services: SERVICE_IDS.map((serviceId, index) => ({
|
||||
serviceId,
|
||||
status: "published",
|
||||
artifactRequired: true,
|
||||
image: `127.0.0.1:5000/hwlab/${serviceId}:${shortCommitId}`,
|
||||
imageTag: shortCommitId,
|
||||
digest: digestFor(index),
|
||||
repositoryDigest: `127.0.0.1:5000/hwlab/${serviceId}@${digestFor(index)}`
|
||||
}))
|
||||
}
|
||||
}, null, 2)}\n`);
|
||||
|
||||
const result = await execFileAsync(process.execPath, [
|
||||
"scripts/refresh-artifact-catalog.mjs",
|
||||
"--target-ref",
|
||||
"HEAD",
|
||||
"--publish-report",
|
||||
reportPath
|
||||
], {
|
||||
cwd: repoRoot,
|
||||
timeout: 15000,
|
||||
maxBuffer: 10 * 1024 * 1024
|
||||
});
|
||||
const payload = JSON.parse(result.stdout);
|
||||
assert.equal(payload.status, "published");
|
||||
assert.deepEqual(payload.wrote, []);
|
||||
assert.equal(payload.deployTruthPolicy, "deploy.json is human-authored runtime config; artifact promotion must not rewrite it");
|
||||
});
|
||||
|
||||
test("refresh keeps reused service image tags from the publish report", async () => {
|
||||
const commitId = await git(["rev-parse", "HEAD"]);
|
||||
const shortCommitId = await git(["rev-parse", "--short=7", "HEAD"]);
|
||||
|
||||
@@ -98,7 +98,7 @@ export function evaluateArtifactRuntimeReadiness({
|
||||
pass: commitsMatch(catalog.commitId, target.commitId),
|
||||
type: "observability_blocker",
|
||||
summary: `Artifact catalog commit=${catalog.shortCommitId}; target=${target.shortCommitId}.`,
|
||||
nextTask: "Refresh desired-state and artifact catalog identity to latest origin/main before apply."
|
||||
nextTask: "Do not refresh source desired-state. Let G14 Tekton promotion write artifact catalog identity to G14-gitops, then verify Argo/runtime revision."
|
||||
});
|
||||
addCheck(checks, {
|
||||
id: "artifact-report-catalog-match",
|
||||
@@ -119,7 +119,7 @@ export function evaluateArtifactRuntimeReadiness({
|
||||
pass: desiredState.matchesTarget,
|
||||
type: "observability_blocker",
|
||||
summary: `Desired-state deploy=${desiredState.deployCommitId}; target=${target.shortCommitId}; convergence=${desiredState.targetConvergence.state}; pending=${desiredState.targetConvergence.pendingTargetFields}.`,
|
||||
nextTask: `Run node scripts/deploy-desired-state-plan.mjs --promotion-commit ${target.shortCommitId} --check after refreshing desired-state for latest origin/main.`
|
||||
nextTask: `Run node scripts/deploy-desired-state-plan.mjs --promotion-commit ${target.shortCommitId} --check as a read-only review, then rely on G14 Tekton promotion for catalog writes.`
|
||||
});
|
||||
addCheck(checks, {
|
||||
id: "rollout-read-access",
|
||||
@@ -140,7 +140,7 @@ export function evaluateArtifactRuntimeReadiness({
|
||||
pass: apiRuntime.observed && commitsMatch(apiRuntime.commitId, target.commitId),
|
||||
type: "runtime_blocker",
|
||||
summary: `API /health/live commit=${apiRuntime.shortCommitId}; target=${target.shortCommitId}.`,
|
||||
nextTask: "After publish and desired-state refresh, run the authorized DEV rollout path and re-observe /health/live."
|
||||
nextTask: "After publish and GitOps promotion, verify Argo DEV rollout and re-observe /health/live."
|
||||
});
|
||||
addCheck(checks, {
|
||||
id: "api-runtime-artifact-match",
|
||||
|
||||
@@ -709,8 +709,8 @@ function targetCommands(target) {
|
||||
if (target.targetRef) {
|
||||
commands.push(
|
||||
`node scripts/deploy-desired-state-plan.mjs --target-ref ${target.targetRef} --pretty`,
|
||||
`node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --blocked`,
|
||||
`node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --publish-report ${artifactReportPath}`
|
||||
`node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --blocked --no-write`,
|
||||
`node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --publish-report ${artifactReportPath} --no-write`
|
||||
);
|
||||
}
|
||||
return commands;
|
||||
@@ -971,7 +971,7 @@ export async function buildDesiredStatePlan(options = {}) {
|
||||
humanAuthoredTruth: [deployPath, workloadsPath],
|
||||
artifactIdentityTruth: [catalogPath],
|
||||
nonAuthoritativeEvidence: [artifactReportPath],
|
||||
note: "This planner reviews source desired-state only. deploy.json is human-authored config; artifact-catalog carries generated image identity. It does not prove image existence, registry reachability, a real DEV apply, or M3 DEV-LIVE hardware-loop evidence."
|
||||
note: "This planner is read-only. deploy.json is human-authored config; artifact-catalog carries generated image identity and is written by G14 Tekton promotion only to G14-gitops. It does not prove image existence, registry reachability, a real DEV apply, or M3 DEV-LIVE hardware-loop evidence."
|
||||
},
|
||||
cloudApiDb: cloudApiDb ?? {
|
||||
status: "blocked",
|
||||
|
||||
@@ -465,8 +465,8 @@ async function artifactIdentityFor({ deploy, catalog, artifactReport, targetComm
|
||||
matchesSource: targetCoverage.covered && catalogMatchesSource && servicesMatchSource,
|
||||
publishVerified,
|
||||
refreshCommands: {
|
||||
blocked: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --blocked`,
|
||||
published: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --publish-report ${defaultArtifactReportPath}`
|
||||
blocked: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --blocked --no-write`,
|
||||
published: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --publish-report ${defaultArtifactReportPath} --no-write`
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user