feat(ql3): govern release version transitions

This commit is contained in:
whyour
2026-08-16 09:32:27 +08:00
parent 7130d77a76
commit bad8399cc3
24 changed files with 1462 additions and 128 deletions
@@ -30,6 +30,7 @@ test('accepts the reviewed native CI and digest release contracts', () => {
clusterAdminOperatorContext: true,
clusterAdminContextPreflight: true,
clusterAdminContextReadiness: true,
releaseVersionAudit: true,
ociAttestations: true,
osVulnerabilityScan: {
scanner: 'trivy@0.70.0',
@@ -105,6 +106,17 @@ test('accepts the reviewed native CI and digest release contracts', () => {
});
});
test('rejects removal of the source-derived release version audit', () => {
const mutated = ciSource.replace(
'pnpm audit:release-version:ql3',
'echo release-version-audit-removed',
);
assert.throws(
() => auditClusterImageCiWorkflow(mutated),
/source-derived release version identity/,
);
});
test('rejects removal of the native arm64 image gate', () => {
const mutated = ciSource.replace(
'runner: ubuntu-24.04-arm\n node_arch: arm64\n image_arch: arm64\n image: control',