feat(ql3): materialize auditable local trial kits

2026-09-20 16:07:11 +08:00 · 2026-08-26 09:58:29 +08:00
parent 2253b99066
commit 2620be0587
11 changed files with 1026 additions and 81 deletions
@@ -583,74 +583,27 @@ jobs:
            --report="${{ runner.temp }}/ql3-local-api-cancellation/edge.json"
          node scripts/ql3-local-api-cancellation-live-audit.cjs \
            --report="${{ runner.temp }}/ql3-local-api-cancellation/standalone.json"
-      - name: Package the tested native Local Alpha image
+      - name: Materialize and offline-audit the native Local Alpha trial kit
        if: github.event_name == 'workflow_dispatch' && inputs.produce_alpha_artifacts
        env:
          IMAGE: qinglong3-local-application:ci-${{ matrix.image_arch }}
-          IMAGE_ARCH: ${{ matrix.image_arch }}
-          BUNDLE_ROOT: ${{ runner.temp }}/ql3-alpha-local-${{ matrix.image_arch }}
+          OPERATOR_IMAGE: qinglong3-local-operator:ci-${{ matrix.image_arch }}
        run: |
          set -euo pipefail
          umask 077
-          mkdir "${BUNDLE_ROOT}"
-          archive="${BUNDLE_ROOT}/qinglong3-local-trial-kit-${IMAGE_ARCH}.docker.tar"
-          docker image save --output "${archive}" \
-            "${IMAGE}" \
-            "qinglong3-local-operator:ci-${IMAGE_ARCH}"
-          cp "${RUNNER_TEMP}/ql3-local-application.cdx.json" \
-            "${BUNDLE_ROOT}/qinglong3-local-application.cdx.json"
-          cp "${RUNNER_TEMP}/ql3-local-operator.cdx.json" \
-            "${BUNDLE_ROOT}/qinglong3-local-operator.cdx.json"
-          cp docs/operations/ql3-alpha-candidate.md "${BUNDLE_ROOT}/README.md"
-          archive_sha256="sha256:$(sha256sum "${archive}" | cut -d ' ' -f 1)"
-          ARCHIVE="${archive}" ARCHIVE_SHA256="${archive_sha256}" \
-            MANIFEST="${BUNDLE_ROOT}/manifest.json" \
-            node <<'NODE'
-          const fs = require('node:fs');
-          const childProcess = require('node:child_process');
-          const release = require('./ql3-release.json');
-          const imageId = childProcess
-            .execFileSync('docker', ['image', 'inspect', '--format', '{{.Id}}', process.env.IMAGE], { encoding: 'utf8' })
-            .trim();
-          const operatorImage = `qinglong3-local-operator:ci-${process.env.IMAGE_ARCH}`;
-          const operatorImageId = childProcess
-            .execFileSync('docker', ['image', 'inspect', '--format', '{{.Id}}', operatorImage], { encoding: 'utf8' })
-            .trim();
-          const manifest = {
-            schemaVersion: 2,
-            schema: 'qinglong/alpha-local-trial-kit@v1',
-            maturity: 'alpha_candidate_not_public_release',
-            product: 'local',
-            version: release.version,
-            sourceRevision: process.env.GITHUB_SHA,
-            architecture: process.env.IMAGE_ARCH,
-            image: process.env.IMAGE,
-            imageId,
-            archive: process.env.ARCHIVE.split('/').pop(),
-            archiveSha256: process.env.ARCHIVE_SHA256,
-            operator: {
-              lifecycle: 'short-lived',
-              network: 'none-by-default',
-              image: operatorImage,
-              imageId: operatorImageId,
-              archive: process.env.ARCHIVE.split('/').pop(),
-              archiveSha256: process.env.ARCHIVE_SHA256,
-            },
-            verification: {
-              osVulnerabilityPolicy: 'passed',
-              sbomInventoryReconciliation: 'passed',
-              router128MiBEntrypoint: 'passed',
-              operator128MiBEntrypoint: 'passed',
-              operatorPackageInventory: 'passed',
-              freshOwnerJourney: 'passed',
-              edgeFreshLifecycle: 'passed',
-              standaloneFreshLifecycle: 'passed',
-              localApiCancellation: 'passed',
-            },
-          };
-          fs.writeFileSync(process.env.MANIFEST, `${JSON.stringify(manifest)}\n`, { mode: 0o600, flag: 'wx' });
-          NODE
-      - name: Upload the tested native Local Alpha image
+          node scripts/ql3-local-alpha-trial-kit-bundle.cjs \
+            --mode=create \
+            --application-image="${IMAGE}" \
+            --operator-image="${OPERATOR_IMAGE}" \
+            --architecture=${{ matrix.image_arch }} \
+            --source-revision=${{ github.sha }} \
+            --application-sbom="${RUNNER_TEMP}/ql3-local-application.cdx.json" \
+            --operator-sbom="${RUNNER_TEMP}/ql3-local-operator.cdx.json" \
+            --readme=docs/operations/ql3-local-alpha-trial-kit.md \
+            --output="${RUNNER_TEMP}/ql3-alpha-local-${{ matrix.image_arch }}"
+          node scripts/ql3-local-alpha-trial-kit-bundle.cjs \
+            --mode=audit --bundle="${RUNNER_TEMP}/ql3-alpha-local-${{ matrix.image_arch }}"
+      - name: Upload the tested native Local Alpha trial kit
        if: github.event_name == 'workflow_dispatch' && inputs.produce_alpha_artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with: