mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
feat(ql3): gate release tags on deployment readiness
This commit is contained in:
whyour
@@ -0,0 +1,327 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const crypto = require('node:crypto');
|
||||
const test = require('node:test');
|
||||
const {
|
||||
SCHEMA,
|
||||
auditDeploymentReadinessReceipt,
|
||||
createDeploymentReadinessReceipt,
|
||||
parseArguments,
|
||||
validateDeploymentReadinessReceipt,
|
||||
} = require('../../scripts/ql3-release-deployment-readiness-contract.cjs');
|
||||
|
||||
const VERSION = '3.0.0-alpha.0';
|
||||
const REVISION = 'd'.repeat(40);
|
||||
const OWNER = 'qinglong-release';
|
||||
const SOURCE_REPOSITORY = `${OWNER}/qinglong`;
|
||||
const MANIFEST_DIGEST = `sha256:${'a'.repeat(64)}`;
|
||||
const RELEASE_SET_DIGEST = `sha256:${'b'.repeat(64)}`;
|
||||
|
||||
function sha256(value) {
|
||||
return `sha256:${crypto.createHash('sha256').update(value).digest('hex')}`;
|
||||
}
|
||||
|
||||
function identity(scope) {
|
||||
return {
|
||||
version: VERSION,
|
||||
sourceRevision: REVISION,
|
||||
sourceRef: `refs/tags/v${VERSION}`,
|
||||
releaseScope: scope,
|
||||
repositoryOwner: OWNER,
|
||||
sourceRepository: SOURCE_REPOSITORY,
|
||||
};
|
||||
}
|
||||
|
||||
function consumption(scope, marker) {
|
||||
return {
|
||||
compatible: true,
|
||||
releaseScope: scope,
|
||||
sourceRepository: SOURCE_REPOSITORY,
|
||||
workflowIdentity: `https://github.com/${SOURCE_REPOSITORY}/.github/workflows/ql3-image-release.yml@refs/tags/v${VERSION}`,
|
||||
releaseSetDigest: RELEASE_SET_DIGEST,
|
||||
catalogManifestDigest: MANIFEST_DIGEST,
|
||||
immutableReference: `ghcr.io/${OWNER}/qinglong3-release-catalog@${MANIFEST_DIGEST}`,
|
||||
imageCount: scope === 'all' ? 5 : scope === 'local' ? 1 : 4,
|
||||
discoveryTagAuthority: 'none',
|
||||
externalToolResultsReplayed: false,
|
||||
deploymentMutation: false,
|
||||
contentDigest: sha256(marker),
|
||||
releaseSet: {
|
||||
release: {
|
||||
version: VERSION,
|
||||
sourceRevision: REVISION,
|
||||
sourceRef: `refs/tags/v${VERSION}`,
|
||||
scope,
|
||||
},
|
||||
releaseSetDigest: RELEASE_SET_DIGEST,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function reportEntry(value) {
|
||||
return {
|
||||
value,
|
||||
digest: sha256(`${JSON.stringify(value)}\n`),
|
||||
};
|
||||
}
|
||||
|
||||
function localReport(scope, catalog, profile) {
|
||||
return reportEntry({
|
||||
schemaVersion: 1,
|
||||
profile,
|
||||
generation: 2,
|
||||
exactRepoDigest: true,
|
||||
composeMerge: true,
|
||||
rolloutActive: true,
|
||||
durableReceipt: true,
|
||||
sqliteWriteContract: 37,
|
||||
sqliteBackup: true,
|
||||
sqliteWriteObservation: { committed: true },
|
||||
sqliteRestorePrepared: true,
|
||||
sqliteRestoreCommitted: true,
|
||||
sqliteRestoreRolloutRecovered: true,
|
||||
sqliteRestoreReplayUnchanged: true,
|
||||
sqliteEvidenceCollected: true,
|
||||
sqliteCollectedRolloutReplayUnchanged: true,
|
||||
gracefulCleanup: true,
|
||||
releaseAuthority: {
|
||||
mode: 'verified_release_catalog',
|
||||
sourceRevision: REVISION,
|
||||
sourceRef: `refs/tags/v${VERSION}`,
|
||||
scope,
|
||||
releaseSetDigest: RELEASE_SET_DIGEST,
|
||||
catalogManifestDigest: MANIFEST_DIGEST,
|
||||
catalogConsumptionDigest: catalog.contentDigest,
|
||||
selectionDigest: sha256('selection'),
|
||||
},
|
||||
compatible: true,
|
||||
});
|
||||
}
|
||||
|
||||
function clusterReport(scope, catalog) {
|
||||
return reportEntry({
|
||||
schemaVersion: 1,
|
||||
schema: 'qinglong/kubernetes-deployment-live-evidence@v1',
|
||||
kubernetes: {
|
||||
serverVersion: 'v1.34.3+k3s1',
|
||||
architecture: 'linux/amd64',
|
||||
nodeCount: 3,
|
||||
clusterUid: 'fixture-cluster',
|
||||
},
|
||||
deployment: {
|
||||
namespace: 'qinglong3-system',
|
||||
resourceCount: 7,
|
||||
deploymentCount: 4,
|
||||
replicas: 0,
|
||||
fieldManager: 'qinglong3-catalog-lock',
|
||||
immutableImages: true,
|
||||
headName: 'ql3-deployment-head',
|
||||
headPhase: 'committed',
|
||||
headGeneration: 2,
|
||||
deploymentDigest: sha256('deployment'),
|
||||
resourceInventoryCount: 6,
|
||||
},
|
||||
releaseAuthority: {
|
||||
mode: 'verified_release_catalog',
|
||||
version: VERSION,
|
||||
sourceRevision: REVISION,
|
||||
sourceRef: `refs/tags/v${VERSION}`,
|
||||
scope,
|
||||
releaseSetDigest: RELEASE_SET_DIGEST,
|
||||
catalogManifestDigest: MANIFEST_DIGEST,
|
||||
catalogConsumptionDigest: catalog.contentDigest,
|
||||
immutableReference: catalog.immutableReference,
|
||||
},
|
||||
preflightDigest: sha256('preflight'),
|
||||
receiptDigest: sha256('receipt'),
|
||||
receiptAuditCompatible: true,
|
||||
retirement: {
|
||||
preflightDigest: sha256('retirement-preflight'),
|
||||
receiptDigest: sha256('retirement-receipt'),
|
||||
receiptAuditCompatible: true,
|
||||
targetCount: 1,
|
||||
targetAbsent: true,
|
||||
uidResourceVersionDeletePreconditions: true,
|
||||
deploymentHeadCas: true,
|
||||
inventoryCount: 6,
|
||||
unixSocketProxy: true,
|
||||
},
|
||||
serverSideDryRun: true,
|
||||
serverSideApply: true,
|
||||
convergenceRead: true,
|
||||
deploymentHeadCas: true,
|
||||
resourceInventoryClosed: true,
|
||||
crossResourceAtomicity: false,
|
||||
cleanupComplete: true,
|
||||
});
|
||||
}
|
||||
|
||||
function fixture(scope = 'all') {
|
||||
const finalizerConsumption = consumption(scope, 'finalizer');
|
||||
const input = {
|
||||
identity: identity(scope),
|
||||
finalizerConsumption,
|
||||
};
|
||||
if (scope !== 'cluster') {
|
||||
const localConsumption = consumption(scope, 'local');
|
||||
input.local = {
|
||||
consumption: localConsumption,
|
||||
edge: localReport(scope, localConsumption, 'edge'),
|
||||
standalone: localReport(scope, localConsumption, 'standalone'),
|
||||
};
|
||||
}
|
||||
if (scope !== 'local') {
|
||||
const clusterConsumption = consumption(scope, 'cluster');
|
||||
input.cluster = {
|
||||
consumption: clusterConsumption,
|
||||
report: clusterReport(scope, clusterConsumption),
|
||||
};
|
||||
}
|
||||
return { input, receipt: createDeploymentReadinessReceipt(input) };
|
||||
}
|
||||
|
||||
test('requires the exact deployment families for Local, Cluster and All', () => {
|
||||
for (const [scope, families, reportCount] of [
|
||||
['local', ['local'], 2],
|
||||
['cluster', ['cluster'], 1],
|
||||
['all', ['local', 'cluster'], 3],
|
||||
]) {
|
||||
const { input, receipt } = fixture(scope);
|
||||
assert.equal(receipt.schema, SCHEMA);
|
||||
assert.deepEqual(receipt.requiredDeploymentFamilies, families);
|
||||
assert.equal(
|
||||
auditDeploymentReadinessReceipt(receipt, input).reportCount,
|
||||
reportCount,
|
||||
);
|
||||
assert.equal(
|
||||
validateDeploymentReadinessReceipt(receipt, {
|
||||
release: receipt.release,
|
||||
sourceRepository: SOURCE_REPOSITORY,
|
||||
releaseSetDigest: RELEASE_SET_DIGEST,
|
||||
catalogManifestDigest: MANIFEST_DIGEST,
|
||||
immutableReference: receipt.catalog.immutableReference,
|
||||
}),
|
||||
receipt,
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
test('rejects missing, extra and cross-scope deployment evidence', () => {
|
||||
const local = fixture('local').input;
|
||||
assert.throws(
|
||||
() =>
|
||||
createDeploymentReadinessReceipt({
|
||||
...local,
|
||||
local: undefined,
|
||||
}),
|
||||
/local deployment catalog consumption is invalid/,
|
||||
);
|
||||
assert.throws(
|
||||
() =>
|
||||
createDeploymentReadinessReceipt({
|
||||
...local,
|
||||
cluster: fixture('cluster').input.cluster,
|
||||
}),
|
||||
/cluster deployment evidence is forbidden/,
|
||||
);
|
||||
const all = fixture('all').input;
|
||||
assert.throws(
|
||||
() =>
|
||||
createDeploymentReadinessReceipt({
|
||||
...all,
|
||||
cluster: undefined,
|
||||
}),
|
||||
/cluster deployment catalog consumption is invalid/,
|
||||
);
|
||||
});
|
||||
|
||||
test('rejects reports detached from the independently consumed catalog', () => {
|
||||
const current = fixture('all').input;
|
||||
const drifted = structuredClone(current);
|
||||
drifted.local.consumption.catalogManifestDigest = sha256('other-manifest');
|
||||
drifted.local.consumption.immutableReference = `ghcr.io/${OWNER}/qinglong3-release-catalog@${drifted.local.consumption.catalogManifestDigest}`;
|
||||
drifted.local.edge.value.releaseAuthority.catalogManifestDigest =
|
||||
drifted.local.consumption.catalogManifestDigest;
|
||||
drifted.local.standalone.value.releaseAuthority.catalogManifestDigest =
|
||||
drifted.local.consumption.catalogManifestDigest;
|
||||
assert.throws(
|
||||
() => createDeploymentReadinessReceipt(drifted),
|
||||
/detached from the finalizer catalog/,
|
||||
);
|
||||
});
|
||||
|
||||
test('rejects synthetic, incomplete and unclean deployment reports', () => {
|
||||
for (const mutate of [
|
||||
(input) => {
|
||||
input.local.edge.value.releaseAuthority.mode = 'synthetic_live_fixture';
|
||||
},
|
||||
(input) => {
|
||||
input.local.standalone.value.gracefulCleanup = false;
|
||||
},
|
||||
(input) => {
|
||||
input.cluster.report.value.receiptAuditCompatible = false;
|
||||
},
|
||||
(input) => {
|
||||
input.cluster.report.value.cleanupComplete = false;
|
||||
},
|
||||
]) {
|
||||
const input = structuredClone(fixture('all').input);
|
||||
mutate(input);
|
||||
assert.throws(
|
||||
() => createDeploymentReadinessReceipt(input),
|
||||
/deployment evidence is invalid/,
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
test('rejects tampered, recomputed or authority-detached receipts', () => {
|
||||
const { receipt } = fixture('all');
|
||||
const tampered = structuredClone(receipt);
|
||||
tampered.receiptDigest = sha256('tampered');
|
||||
assert.throws(
|
||||
() => validateDeploymentReadinessReceipt(tampered),
|
||||
/receipt digest is invalid/,
|
||||
);
|
||||
const recomputed = structuredClone(receipt);
|
||||
recomputed.evidence[0].unexpected = true;
|
||||
delete recomputed.receiptDigest;
|
||||
recomputed.receiptDigest = sha256(JSON.stringify(recomputed));
|
||||
assert.throws(
|
||||
() => validateDeploymentReadinessReceipt(recomputed),
|
||||
/evidence summary is invalid/,
|
||||
);
|
||||
assert.throws(
|
||||
() =>
|
||||
validateDeploymentReadinessReceipt(receipt, {
|
||||
releaseSetDigest: sha256('another-release-set'),
|
||||
}),
|
||||
/authority is detached/,
|
||||
);
|
||||
});
|
||||
|
||||
test('accepts only closed scope-specific CLI argument sets', () => {
|
||||
const common = [
|
||||
'--mode=create',
|
||||
`--version=${VERSION}`,
|
||||
`--source-revision=${REVISION}`,
|
||||
`--source-ref=refs/tags/v${VERSION}`,
|
||||
'--release-scope=local',
|
||||
`--repository-owner=${OWNER}`,
|
||||
`--source-repository=${SOURCE_REPOSITORY}`,
|
||||
'--finalizer-consumption-bundle=/tmp/finalizer',
|
||||
'--local-consumption-bundle=/tmp/local',
|
||||
'--edge-report=/tmp/edge',
|
||||
'--standalone-report=/tmp/standalone',
|
||||
'--output=/tmp/receipt',
|
||||
];
|
||||
assert.equal(parseArguments(common).releaseScope, 'local');
|
||||
assert.throws(
|
||||
() => parseArguments([...common, '--cluster-report=/tmp/cluster']),
|
||||
/arguments are invalid/,
|
||||
);
|
||||
assert.throws(
|
||||
() => parseArguments(common.filter((entry) => !entry.startsWith('--edge'))),
|
||||
/arguments are invalid/,
|
||||
);
|
||||
});
|
||||
Reference in New Issue
Block a user