feat(ql3): add read-only cluster context readiness

This commit is contained in:
whyour
2026-08-13 02:14:17 +08:00
parent a83b4c5e8d
commit a6ad636251
18 changed files with 1529 additions and 391 deletions
+3 -2
View File
@@ -289,8 +289,8 @@ function auditClusterImageCiWorkflow(
);
requirePattern(
adminProductLiveContract,
/runOperatorContextContract\(image\);[\s\S]*operatorContext: true,[\s\S]*contextPreflight: true/,
'native admin image contract must verify owner-private operator context injection and offline preflight',
/runOperatorContextContract\(image\);[\s\S]*operatorContext: true,[\s\S]*contextPreflight: true,[\s\S]*contextReadiness: true/,
'native admin image contract must verify owner-private operator context injection, offline preflight and read-only readiness',
);
requirePattern(
source,
@@ -335,6 +335,7 @@ function auditClusterImageCiWorkflow(
clusterAdminProductFacade: true,
clusterAdminOperatorContext: true,
clusterAdminContextPreflight: true,
clusterAdminContextReadiness: true,
ociAttestations: true,
osVulnerabilityScan: {
scanner: 'trivy@0.70.0',