From f415488c7d5aaf22b75ac34e9fb99522ca7051ee Mon Sep 17 00:00:00 2001
From: root <root@v2202607378382480008.hotsrv.de>
Date: Wed, 22 Jul 2026 16:54:35 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=AF=B9=E9=BD=90=20HWLAB=20consumer=20?=
 =?UTF-8?q?=E5=8F=91=E5=B8=83=E8=AE=A1=E5=88=92=E4=BF=A1=E5=B0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .tekton/hwlab-nc01-v03-pac.yaml     |  2 +-
 scripts/ci-plan-identity.test.mjs   | 10 ++++++++--
 scripts/ci/verify-reviewed-plan.mjs | 10 ++++++----
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/.tekton/hwlab-nc01-v03-pac.yaml b/.tekton/hwlab-nc01-v03-pac.yaml
index 02faf270..bdf7eebc 100644
--- a/.tekton/hwlab-nc01-v03-pac.yaml
+++ b/.tekton/hwlab-nc01-v03-pac.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     pipelinesascode.tekton.dev/on-event: "[push]"
     pipelinesascode.tekton.dev/on-target-branch: "[v0.3]"
-    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'v0.3' && node == 'NC01'"
+    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'v0.3' && node == 'NC01' && body.head_commit.message.startsWith('unidesk-release-plan-v1.hwlab-nc01-v03.')"
     pipelinesascode.tekton.dev/max-keep-runs: "8"
     unidesk.ai/owning-config-ref: "config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01"
     unidesk.ai/effective-config-sha256: sha256:f42181ba9c079806968bb8374967a2bc710c7a87b56030d512cc00c004be126b
diff --git a/scripts/ci-plan-identity.test.mjs b/scripts/ci-plan-identity.test.mjs
index 7747eb3a..fde42189 100644
--- a/scripts/ci-plan-identity.test.mjs
+++ b/scripts/ci-plan-identity.test.mjs
@@ -47,11 +47,17 @@ test("reviewed plan admission rejects scope additions before build", () => {
 test("reviewed plan envelope round trips without a second authority", () => {
   const plan = identifiedPlan({ rolloutServices: ["api"], affectedServices: ["api"] });
   const expected = envelope(plan);
-  const encoded = `unidesk-release-plan-v1.${Buffer.from(JSON.stringify(expected)).toString("base64url")}`;
-  assert.deepEqual(decodeReviewedPlan(encoded), expected);
+  const encoded = `unidesk-release-plan-v1.hwlab-nc01-v03.${Buffer.from(JSON.stringify(expected)).toString("base64url")}`;
+  assert.deepEqual(decodeReviewedPlan(encoded, "hwlab-nc01-v03"), expected);
   assert.equal(compareReviewedPlan(expected, plan).ok, true);
 });
 
+test("reviewed plan decoder rejects another consumer", () => {
+  const plan = identifiedPlan({ rolloutServices: ["api"], affectedServices: ["api"] });
+  const encoded = `unidesk-release-plan-v1.hwlab-nc01-production.${Buffer.from(JSON.stringify(envelope(plan))).toString("base64url")}`;
+  assert.throws(() => decodeReviewedPlan(encoded, "hwlab-nc01-v03"), /another consumer/u);
+});
+
 function identifiedPlan(overrides = {}) {
   return attachCiPlanIdentity({
     sourceCommitId: sourceCommit,
diff --git a/scripts/ci/verify-reviewed-plan.mjs b/scripts/ci/verify-reviewed-plan.mjs
index 5547f3b9..61ccf019 100644
--- a/scripts/ci/verify-reviewed-plan.mjs
+++ b/scripts/ci/verify-reviewed-plan.mjs
@@ -5,15 +5,17 @@ import { pathToFileURL } from "node:url";
 if (import.meta.url === pathToFileURL(process.argv[1]).href) {
   const args = parseArgs(process.argv.slice(2));
   const actual = JSON.parse(await readFile(args.actualPlan, "utf8"));
-  const expected = decodeReviewedPlan(args.reviewedPlan);
+  const expected = decodeReviewedPlan(args.reviewedPlan, actual?.planIdentity?.inputs?.consumer);
   const result = compareReviewedPlan(expected, actual);
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (!result.ok) process.exit(42);
 }
 
-export function decodeReviewedPlan(value) {
-  const prefix = "unidesk-release-plan-v1.";
-  if (!String(value).startsWith(prefix)) throw new Error("reviewed plan envelope is missing or unsupported");
+export function decodeReviewedPlan(value, consumer) {
+  const normalizedConsumer = text(consumer);
+  if (!normalizedConsumer) throw new Error("actual plan consumer is missing");
+  const prefix = `unidesk-release-plan-v1.${normalizedConsumer}.`;
+  if (!String(value).startsWith(prefix)) throw new Error("reviewed plan envelope is missing, unsupported, or belongs to another consumer");
   const decoded = Buffer.from(String(value).slice(prefix.length), "base64url").toString("utf8");
   const plan = JSON.parse(decoded);
   if (plan?.version !== "v1") throw new Error("reviewed plan version is unsupported");