open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 03:18:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): close release tags after catalog verification

Browse Source
This commit is contained in:
whyour
2026-08-18 03:53:25 +08:00
parent dbd57b27d0
commit a99f1508f7
12 changed files with 1336 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ql3-cluster-copilot-console-distribution-audit.cjs
+5 -1
View File
@@ -252,10 +252,14 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
'--predicate-type "https://qinglong.dev/attestations/release-candidate-contract/v1"',
'--deny-self-hosted-runners',
'--bundle-from-oci',
'Promote tags only after the complete set is verified',
'Attest the complete release-set file provenance',
'Publish and round-trip the durable OCI release catalog',
'Attest durable release-catalog provenance',
'Verify the durable catalog and create its immutable receipt',
'Attest the immutable release-catalog receipt',
'Promote final tags only after the catalog receipt is attested',
'Close and audit the final public tag set',
'Attest the immutable release publication closure receipt',
],
'QL3_CLUSTER_ADMIN_RELEASE_WORKFLOW_DRIFT',
);