From 45f8218247a9609d63a4b6c0f4cf552993788995 Mon Sep 17 00:00:00 2001
From: whyour <imwhyour@gmail.com>
Date: Sun, 23 Aug 2026 20:33:40 +0800
Subject: [PATCH] fix(ci): align local image contract v51

---
 .github/workflows/ql3-ci.yml          |  2 +-
 scripts/ql3-local-image-audit.cjs     |  1 +
 test/back/ql3LocalImageAudit.test.cjs | 26 ++++++++++++++++++++++++++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ql3-ci.yml b/.github/workflows/ql3-ci.yml
index 4297fa0e..65d11c58 100644
--- a/.github/workflows/ql3-ci.yml
+++ b/.github/workflows/ql3-ci.yml
@@ -391,7 +391,7 @@ jobs:
       - name: Verify non-root identity and architecture
         env:
           IMAGE: qinglong3-local-application:ci-${{ matrix.image_arch }}
-          EXPECTED: ${{ matrix.image_arch }} 65532:65532 2,3,4 50 50 50 1
+          EXPECTED: ${{ matrix.image_arch }} 65532:65532 2,3,4 51 51 51 1
         run: |
           set -euo pipefail
           actual="$(docker image inspect --format '{{.Architecture}} {{.Config.User}} {{index .Config.Labels "io.qinglong.local.application-config"}} {{index .Config.Labels "io.qinglong.local.sqlite-contract-min"}} {{index .Config.Labels "io.qinglong.local.sqlite-contract-max"}} {{index .Config.Labels "io.qinglong.local.sqlite-write-contract"}} {{index .Config.Labels "io.qinglong.local.compose-selection"}}' "${IMAGE}")"
diff --git a/scripts/ql3-local-image-audit.cjs b/scripts/ql3-local-image-audit.cjs
index 320247b6..b251b448 100644
--- a/scripts/ql3-local-image-audit.cjs
+++ b/scripts/ql3-local-image-audit.cjs
@@ -285,6 +285,7 @@ function auditWorkflow(contents, findings) {
     'pnpm audit:local-image:ql3',
     'docker build',
     '--file deploy/containers/ql3-local-application/Dockerfile',
+    'EXPECTED: ${{ matrix.image_arch }} 65532:65532 2,3,4 51 51 51 1',
     'actual="$(docker image inspect --format \'{{.Architecture}} {{.Config.User}} {{index .Config.Labels "io.qinglong.local.application-config"}} {{index .Config.Labels "io.qinglong.local.sqlite-contract-min"}} {{index .Config.Labels "io.qinglong.local.sqlite-contract-max"}} {{index .Config.Labels "io.qinglong.local.sqlite-write-contract"}} {{index .Config.Labels "io.qinglong.local.compose-selection"}}\' "${IMAGE}")"',
     'io.qinglong.local.application-config',
     'io.qinglong.local.sqlite-contract-min',
diff --git a/test/back/ql3LocalImageAudit.test.cjs b/test/back/ql3LocalImageAudit.test.cjs
index 8d9d42dc..26e1b97c 100644
--- a/test/back/ql3LocalImageAudit.test.cjs
+++ b/test/back/ql3LocalImageAudit.test.cjs
@@ -255,3 +255,29 @@ test('rejects removal of either Profile from the native image CI gate', () => {
     current.close();
   }
 });
+
+test('rejects a stale SQLite contract expectation in the native image CI gate', () => {
+  const current = fixture();
+  try {
+    const workflowPath = path.join(
+      current.root,
+      '.github/workflows/ql3-ci.yml',
+    );
+    const workflow = fs
+      .readFileSync(workflowPath, 'utf8')
+      .replace(
+        'EXPECTED: ${{ matrix.image_arch }} 65532:65532 2,3,4 51 51 51 1',
+        'EXPECTED: ${{ matrix.image_arch }} 65532:65532 2,3,4 50 50 50 1',
+      );
+    fs.writeFileSync(workflowPath, workflow);
+    const report = auditLocalImageContract(current.root);
+    assert.equal(report.compatible, false);
+    assert.ok(
+      report.findings.some(
+        ({ code }) => code === 'LOCAL_IMAGE_CI_CONTRACT_DRIFT',
+      ),
+    );
+  } finally {
+    current.close();
+  }
+});