open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): scope deployment-family release candidates

Browse Source
This commit is contained in:
whyour
2026-08-16 08:54:51 +08:00
parent d991deb7ee
commit 7130d77a76
27 changed files with 1332 additions and 303 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/console/ql3-cluster-copilot/README.md
+3 -2
View File
@@ -37,7 +37,7 @@ deploy/console/ql3-cluster-copilot/verify-release.sh \
For a release acceptance ceremony, prefer the source-tag workstation runner.
Create a current-owner `0700` report directory and a canonical `0600` file
containing only a short-lived GitHub token. Pass canonical absolute executable
paths (resolve Homebrew symlinks first). The token is sent only to the three
paths (resolve Homebrew symlinks first). The token is sent only to the four
`gh attestation verify` children, never in argv, the report or the `cosign` and
`docker` environments.
@@ -54,7 +54,8 @@ node scripts/ql3-cluster-admin-release-workstation-ceremony.cjs \
--output=/absolute/private/release/admin-ceremony.json
```
In addition to the signature, provenance, CycloneDX and OS-vulnerability
In addition to the signature, provenance, CycloneDX, OS-vulnerability and
source-derived release-candidate contract
checks, the runner pulls the same immutable digest, confirms its local
`RepoDigests` binding, and runs the image-carried `evidence-verify` command on
a fixed non-sensitive vector with network disabled, a read-only root, no