open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 03:18:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): publish complete release sets

Browse Source
This commit is contained in:
whyour
2026-08-16 10:06:34 +08:00
parent bad8399cc3
commit 41549524d4
16 changed files with 1302 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/kubernetes/ql3-cluster/README.md
+7 -4
View File
@@ -161,10 +161,13 @@ pnpm audit:cluster-remote-manifest:ql3 \
```
The existence of the workflow is not publication evidence. Before production
rollout, record a successful release run for both image repositories,
independently verify each signature and attestation set, and pin both resulting
`sha256:` digests. Never treat the version tag or the control image's proof as
authority for the admin Job.
rollout, obtain the `cluster` or `all` deployment release set from a successful
release run, verify its file provenance, and pin the four control, control-ai,
worker and admin `sha256:` references recorded in that one source-bound set.
Never treat the version tag, a partial matrix run or one image's proof as
authority for another role. The exact operator procedure and non-atomic tag
recovery boundary are documented in
[`docs/operations/ql3-release-set-deployment.md`](../../../docs/operations/ql3-release-set-deployment.md).
The committed CloudNativePG control, migration and Plugin Package recovery overlays use
an all-zero SHA-256 digest as an intentionally unpullable fail-closed