fix(ci): align kubernetes live evidence

scripts/ql3-cloudnativepg-live-contract.cjs

@@ -9,6 +9,10 @@ const os = require('node:os');
 const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 const { readReleaseIdentity } = require('./lib/ql3-release-identity.cjs');
+const {
+  postgresqlControlSchemaContract,
+  postgresqlMainMigrationStream,
+} = require('../packages/ql3-cluster-postgres/dist/migration/migration.js');
 
 const ROOT = path.resolve(__dirname, '..');
 const QL3_VERSION = readReleaseIdentity(ROOT).version;
@@ -59,6 +63,8 @@ const ROLE_NAMES = Object.freeze([
   'ql3_worker_credential_manager',
   'ql3_worker_ingress',
 ]);
+const MIGRATION_COUNT = postgresqlMainMigrationStream.migrations.length;
+const CONTRACT_VERSION = postgresqlControlSchemaContract.contractVersion;
 
 function fail(message) {
   throw new Error(message);
@@ -385,13 +391,13 @@ function roleEvidence(podName) {
           FROM ql3.schema_capabilities
          WHERE contract_name = 'control-core')`,
   ).split('\t');
-  assert.deepEqual(schema, ['53', '52']);
+  assert.deepEqual(schema, [String(MIGRATION_COUNT), String(CONTRACT_VERSION)]);
   return {
     roles: rows.map((row) => row[0]),
     login: true,
     elevatedAttributes: false,
-    migrationCount: 54,
-    contractVersion: 53,
+    migrationCount: MIGRATION_COUNT,
+    contractVersion: CONTRACT_VERSION,
   };
 }
 

scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs

@@ -33,6 +33,8 @@ const POSTGRES_INDEX_DIGEST =
   'sha256:1961f96e6029a02c3812d7cb329a3b03a3ac2bb067058dec17b0f5596aca9296';
 const POSTGRES_IMAGE_REFERENCE = `${POSTGRES_IMAGE}@${POSTGRES_INDEX_DIGEST}`;
 const POSTGRES_REPOSITORY_DIGEST = `postgres@${POSTGRES_INDEX_DIGEST}`;
+const POSTGRES_RUNTIME_IMAGE =
+  'postgres:18.4-bookworm-ql3-plugin-recovery-e2e';
 const DEFAULT_ADMIN_IMAGE = 'qinglong3-cluster-admin:ql3-plugin-recovery-e2e';
 const DEFAULT_CONTROL_IMAGE =
   'qinglong3-cluster-control:ql3-plugin-recovery-e2e';
@@ -293,6 +295,10 @@ function ensurePostgresImage() {
     inspection.RepoDigests.includes(POSTGRES_REPOSITORY_DIGEST),
     `${POSTGRES_IMAGE} does not match ${POSTGRES_REPOSITORY_DIGEST}`,
   );
+  run(DOCKER, ['image', 'tag', POSTGRES_IMAGE_REFERENCE, POSTGRES_RUNTIME_IMAGE], {
+    label: 'bind verified PostgreSQL fixture digest to its Kind-local tag',
+  });
+  assert.equal(imageId(POSTGRES_RUNTIME_IMAGE), inspection.Id);
 }
 
 function imageId(image) {
@@ -486,7 +492,7 @@ createdb --username "$POSTGRES_USER" --owner ql3_migration qinglong
         containers: [
           {
             name: 'postgres',
-            image: POSTGRES_IMAGE_REFERENCE,
+            image: POSTGRES_RUNTIME_IMAGE,
             imagePullPolicy: 'Never',
             env: [
               { name: 'POSTGRES_USER', value: 'postgres' },
@@ -1730,7 +1736,7 @@ async function main(argv = process.argv.slice(2)) {
     for (const image of [
       ADMIN_IMAGE,
       CONTROL_IMAGE,
-      POSTGRES_IMAGE_REFERENCE,
+      POSTGRES_RUNTIME_IMAGE,
     ]) {
       kind(
         [

scripts/ql3-provider-credential-test-kubernetes-live-audit.cjs

@@ -6,6 +6,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 
 const FIXTURE = 'qinglong/provider-credential-test-kubernetes-live-contract@v1';
+const AI_MIGRATION_COUNT = 21;
 const LIMITATIONS = Object.freeze([
   'three privileged K3s Docker nodes with fixture-only prebound hostPath volumes are not production infrastructure, dynamic storage or control-plane HA evidence',
   'the private HTTPS provider is a deterministic in-cluster fixture rather than an external SaaS provider',
@@ -186,7 +187,7 @@ function validateProviderCredentialTestKubernetesLiveReport(report) {
     database?.managerRole !== 'ql3_ai_credential_manager' ||
     database?.testerRole !== 'ql3_ai_credential_tester' ||
     database?.migrationCount < 50 ||
-    database?.aiMigrationCount !== 15 ||
+    database?.aiMigrationCount !== AI_MIGRATION_COUNT ||
     database?.tlsVerified !== true ||
     database?.primaryChangedDuringFailover !== true
   ) {
@@ -438,6 +439,7 @@ if (require.main === module) {
 }
 
 module.exports = {
+  AI_MIGRATION_COUNT,
   FIXTURE,
   LIMITATIONS,
   validateProviderCredentialTestKubernetesLiveReport,

scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs

@@ -29,6 +29,7 @@ const {
   reviewedOperatorManifest,
 } = require('./ql3-cloudnativepg-live-contract.cjs');
 const {
+  AI_MIGRATION_COUNT,
   FIXTURE,
   LIMITATIONS,
   validateProviderCredentialTestKubernetesLiveReport,
@@ -1453,7 +1454,7 @@ async function main() {
       ),
     );
     assert.equal(databaseFacts.postgresVersionNumber, 180004);
-    assert.equal(databaseFacts.aiMigrationCount, 15);
+    assert.equal(databaseFacts.aiMigrationCount, AI_MIGRATION_COUNT);
 
     psql(
       fixture,