fix: keep deploy manifest human-authored

2026-05-27 10:39:50 +08:00
parent 6ce5dc1439
commit dddfdbf4c9
11 changed files with 116 additions and 55 deletions
@@ -93,6 +93,63 @@ test("refresh accepts an absolute publish report path", async () => {
  assert.equal(payload.services[0].componentInputHash, `${String(1).padStart(64, "a")}`);
 });

+test("refresh is read-only by default", async () => {
+  const commitId = await git(["rev-parse", "HEAD"]);
+  const shortCommitId = await git(["rev-parse", "--short=7", "HEAD"]);
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "hwlab-refresh-default-readonly-"));
+  const reportPath = path.join(tempDir, "dev-artifacts.json");
+  await writeFile(reportPath, `${JSON.stringify({
+    reportVersion: "v1",
+    taskId: "g14-artifact-publish",
+    commitId: shortCommitId,
+    artifactPublish: {
+      status: "published",
+      mode: "publish",
+      sourceCommitId: commitId,
+      registryPrefix: "127.0.0.1:5000/hwlab",
+      serviceCount: SERVICE_IDS.length,
+      requiredServiceCount: SERVICE_IDS.length,
+      disabledServiceCount: 0,
+      publishedCount: SERVICE_IDS.length,
+      publishPlan: {
+        version: "v2",
+        services: SERVICE_IDS.map((serviceId, index) => ({
+          serviceId,
+          required: true,
+          digest: digestFor(index),
+          image: `127.0.0.1:5000/hwlab/${serviceId}:${shortCommitId}`,
+          imageTag: shortCommitId
+        }))
+      },
+      services: SERVICE_IDS.map((serviceId, index) => ({
+        serviceId,
+        status: "published",
+        artifactRequired: true,
+        image: `127.0.0.1:5000/hwlab/${serviceId}:${shortCommitId}`,
+        imageTag: shortCommitId,
+        digest: digestFor(index),
+        repositoryDigest: `127.0.0.1:5000/hwlab/${serviceId}@${digestFor(index)}`
+      }))
+    }
+  }, null, 2)}\n`);
+
+  const result = await execFileAsync(process.execPath, [
+    "scripts/refresh-artifact-catalog.mjs",
+    "--target-ref",
+    "HEAD",
+    "--publish-report",
+    reportPath
+  ], {
+    cwd: repoRoot,
+    timeout: 15000,
+    maxBuffer: 10 * 1024 * 1024
+  });
+  const payload = JSON.parse(result.stdout);
+  assert.equal(payload.status, "published");
+  assert.deepEqual(payload.wrote, []);
+  assert.equal(payload.deployTruthPolicy, "deploy.json is human-authored runtime config; artifact promotion must not rewrite it");
+});
+
 test("refresh keeps reused service image tags from the publish report", async () => {
  const commitId = await git(["rev-parse", "HEAD"]);
  const shortCommitId = await git(["rev-parse", "--short=7", "HEAD"]);