mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: keep deploy manifest human-authored

Browse Source
This commit is contained in:
Codex
2026-05-27 10:39:50 +08:00
parent 6ce5dc1439
commit dddfdbf4c9
11 changed files with 116 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/artifact-runtime-readiness-guard.mjs
+3 -3
View File
@@ -98,7 +98,7 @@ export function evaluateArtifactRuntimeReadiness({
pass: commitsMatch(catalog.commitId, target.commitId),
type: "observability_blocker",
summary: `Artifact catalog commit=${catalog.shortCommitId}; target=${target.shortCommitId}.`,
nextTask: "Refresh desired-state and artifact catalog identity to latest origin/main before apply."
nextTask: "Do not refresh source desired-state. Let G14 Tekton promotion write artifact catalog identity to G14-gitops, then verify Argo/runtime revision."
});
addCheck(checks, {
id: "artifact-report-catalog-match",
@@ -119,7 +119,7 @@ export function evaluateArtifactRuntimeReadiness({
pass: desiredState.matchesTarget,
type: "observability_blocker",
summary: `Desired-state deploy=${desiredState.deployCommitId}; target=${target.shortCommitId}; convergence=${desiredState.targetConvergence.state}; pending=${desiredState.targetConvergence.pendingTargetFields}.`,
nextTask: `Run node scripts/deploy-desired-state-plan.mjs --promotion-commit ${target.shortCommitId} --check after refreshing desired-state for latest origin/main.`
nextTask: `Run node scripts/deploy-desired-state-plan.mjs --promotion-commit ${target.shortCommitId} --check as a read-only review, then rely on G14 Tekton promotion for catalog writes.`
});
addCheck(checks, {
id: "rollout-read-access",
@@ -140,7 +140,7 @@ export function evaluateArtifactRuntimeReadiness({
pass: apiRuntime.observed && commitsMatch(apiRuntime.commitId, target.commitId),
type: "runtime_blocker",
summary: `API /health/live commit=${apiRuntime.shortCommitId}; target=${target.shortCommitId}.`,
nextTask: "After publish and desired-state refresh, run the authorized DEV rollout path and re-observe /health/live."
nextTask: "After publish and GitOps promotion, verify Argo DEV rollout and re-observe /health/live."
});
addCheck(checks, {
id: "api-runtime-artifact-match",
scripts/src/deploy-desired-state-plan.mjs
+3 -3
View File
@@ -709,8 +709,8 @@ function targetCommands(target) {
if (target.targetRef) {
commands.push(
`node scripts/deploy-desired-state-plan.mjs --target-ref ${target.targetRef} --pretty`,
`node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --blocked`,
`node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --publish-report ${artifactReportPath}`
`node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --blocked --no-write`,
`node scripts/refresh-artifact-catalog.mjs --target-ref ${target.targetRef} --publish-report ${artifactReportPath} --no-write`
);
}
return commands;
@@ -971,7 +971,7 @@ export async function buildDesiredStatePlan(options = {}) {
humanAuthoredTruth: [deployPath, workloadsPath],
artifactIdentityTruth: [catalogPath],
nonAuthoritativeEvidence: [artifactReportPath],
note: "This planner reviews source desired-state only. deploy.json is human-authored config; artifact-catalog carries generated image identity. It does not prove image existence, registry reachability, a real DEV apply, or M3 DEV-LIVE hardware-loop evidence."
note: "This planner is read-only. deploy.json is human-authored config; artifact-catalog carries generated image identity and is written by G14 Tekton promotion only to G14-gitops. It does not prove image existence, registry reachability, a real DEV apply, or M3 DEV-LIVE hardware-loop evidence."
},
cloudApiDb: cloudApiDb ?? {
status: "blocked",
scripts/src/dev-gate-preflight.mjs
+2 -2
View File
@@ -465,8 +465,8 @@ async function artifactIdentityFor({ deploy, catalog, artifactReport, targetComm
matchesSource: targetCoverage.covered && catalogMatchesSource && servicesMatchSource,
publishVerified,
refreshCommands: {
blocked: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --blocked`,
published: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --publish-report ${defaultArtifactReportPath}`
blocked: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --blocked --no-write`,
published: `node scripts/refresh-artifact-catalog.mjs --target-ref ${targetRef} --publish-report ${defaultArtifactReportPath} --no-write`
}
};
}