feat(ql3): close public local release pair

.github/workflows/ql3-ci.yml

@@ -386,11 +386,14 @@ jobs:
           --build-arg SOURCE_REVISION=${{ github.sha }}
           --tag "${OPERATOR_IMAGE}"
           .
-      - name: Materialize the reviewed local OS vulnerability exceptions
-        run: >-
-          node scripts/ql3-image-os-vulnerability-policy.cjs
-          --image=local
-          --output=${{ runner.temp }}/ql3-local-${{ matrix.image_arch }}.trivyignore.yaml
+      - name: Materialize the reviewed Local OS vulnerability exceptions
+        run: |
+          node scripts/ql3-image-os-vulnerability-policy.cjs \
+            --image=local \
+            --output=${{ runner.temp }}/ql3-local-${{ matrix.image_arch }}.trivyignore.yaml
+          node scripts/ql3-image-os-vulnerability-policy.cjs \
+            --image=local-operator \
+            --output=${{ runner.temp }}/ql3-local-operator-${{ matrix.image_arch }}.trivyignore.yaml
       - name: Reject unexcepted high or critical local OS vulnerabilities
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
@@ -420,7 +423,7 @@ jobs:
           hide-progress: 'true'
           timeout: '10m0s'
           cache: 'false'
-          trivyignores: ${{ runner.temp }}/ql3-local-${{ matrix.image_arch }}.trivyignore.yaml
+          trivyignores: ${{ runner.temp }}/ql3-local-operator-${{ matrix.image_arch }}.trivyignore.yaml
       - name: Verify non-root identity and architecture
         env:
           IMAGE: qinglong3-local-application:ci-${{ matrix.image_arch }}
@@ -960,6 +963,9 @@ jobs:
           - image: local
             dockerfile: deploy/containers/ql3-local-application/Dockerfile
             target: runtime
+          - image: local-operator
+            dockerfile: deploy/containers/ql3-local-operator/Dockerfile
+            target: runtime
           - image: worker
             dockerfile: deploy/containers/ql3-worker/Dockerfile
             target: runtime

.github/workflows/ql3-image-release.yml

@@ -564,6 +564,27 @@ jobs:
             --docker-socket="${docker_socket}" \
             --profile=standalone
 
+      - name: Verify the short-lived Local operator entrypoint
+        if: matrix.image == 'local-operator'
+        env:
+          IMAGE: ${{ steps.identity.outputs.image }}
+          DIGEST: ${{ steps.push.outputs.digest }}
+        run: |
+          set -euo pipefail
+          docker pull "${IMAGE}@${DIGEST}"
+          for arguments in "--version" "setup --help"; do
+            read -r -a argv <<< "${arguments}"
+            docker run --rm \
+              --read-only \
+              --network none \
+              --cap-drop ALL \
+              --security-opt no-new-privileges \
+              --memory 128m \
+              --cpus 0.5 \
+              --pids-limit 32 \
+              "${IMAGE}@${DIGEST}" "${argv[@]}"
+          done
+
       - name: Verify the keyless signature identity
         env:
           IMAGE: ${{ steps.identity.outputs.image }}
@@ -658,6 +679,7 @@ jobs:
             --repository-owner="${owner}" \
             --candidate="${RUNNER_TEMP}/${{ matrix.repository }}-release-candidate-contract.json" \
             --image="${{ matrix.image }}" \
+            --local-role-verification="${{ matrix.local_role_verification }}" \
             --digest="${DIGEST}" \
             --output="${RUNNER_TEMP}/release-record/${{ matrix.image }}.json"
 
@@ -1107,13 +1129,16 @@ jobs:
           const fs = require('node:fs');
           const selection = JSON.parse(fs.readFileSync(process.env.SELECTION, 'utf8'));
           if (!/^sha256:[a-f0-9]{64}$/.test(selection.selectionDigest || '') ||
-              !/^ghcr\.io\/[a-z0-9._-]+\/qinglong3-local-application@sha256:[a-f0-9]{64}$/.test(selection.service?.image || '')) process.exit(1);
-          process.stdout.write(`selection=${process.env.SELECTION}\nselection-digest=${selection.selectionDigest}\nimage=${selection.service.image}\n`);
+              !/^ghcr\.io\/[a-z0-9._-]+\/qinglong3-local-application@sha256:[a-f0-9]{64}$/.test(selection.service?.image || '') ||
+              !/^ghcr\.io\/[a-z0-9._-]+\/qinglong3-local-operator@sha256:[a-f0-9]{64}$/.test(selection.operator?.image || '') ||
+              selection.operator?.kind !== 'short-lived' || selection.operator?.network !== 'none-by-default') process.exit(1);
+          process.stdout.write(`selection=${process.env.SELECTION}\nselection-digest=${selection.selectionDigest}\nimage=${selection.service.image}\noperator-image=${selection.operator.image}\n`);
           NODE
 
       - name: Prove catalog-bound Edge and Standalone rollout
         env:
           IMAGE: ${{ steps.local-selection.outputs.image }}
+          OPERATOR_IMAGE: ${{ steps.local-selection.outputs.operator-image }}
           RELEASE_SELECTION: ${{ steps.local-selection.outputs.selection }}
           SELECTION_DIGEST: ${{ steps.local-selection.outputs.selection-digest }}
           EVIDENCE_ROOT: ${{ runner.temp }}/ql3-release-catalog-local-deployment
@@ -1124,6 +1149,27 @@ jobs:
           umask 077
           install -d -m 0700 "${EVIDENCE_ROOT}"
           docker pull "${IMAGE}"
+          docker pull "${OPERATOR_IMAGE}"
+          docker run --rm --read-only \
+            --network none \
+            --cap-drop ALL \
+            --security-opt no-new-privileges \
+            --memory=128m \
+            --memory-swap=128m \
+            --cpus=0.5 \
+            --pids-limit=32 \
+            --tmpfs /tmp:rw,nosuid,nodev,noexec,size=8m \
+            "${OPERATOR_IMAGE}" --version
+          docker run --rm --read-only \
+            --network none \
+            --cap-drop ALL \
+            --security-opt no-new-privileges \
+            --memory=128m \
+            --memory-swap=128m \
+            --cpus=0.5 \
+            --pids-limit=32 \
+            --tmpfs /tmp:rw,nosuid,nodev,noexec,size=8m \
+            "${OPERATOR_IMAGE}" setup --help
           docker_executable="$(realpath "$(command -v docker)")"
           docker_socket="$(realpath /var/run/docker.sock)"
           for profile in edge standalone; do