feat(release): operational periphery - resolve, record, healthcheck, cleanup-drafts - #337
Open
JulianRuiseco wants to merge 1 commit into
Open
feat(release): operational periphery - resolve, record, healthcheck, cleanup-drafts#337JulianRuiseco wants to merge 1 commit into
JulianRuiseco wants to merge 1 commit into
Conversation
…cleanup-drafts Stacks on the pipeline core. Nothing here gates a release shipping; these are the commands operators and clients use around one: - resolve: the client download-resolution contract in executable form - pointer lookup with no fallback, schema_version gates that refuse rather than guess, streamed download with incremental sha256, detached signature verified against the published key whose fingerprint must match the manifest's. Uses the shared keyring; proven end to end against a throwaway MinIO (digest and GPG verification both green, and the no-pointer case fails with the exact contract wording). - record: best-effort fsl_sling recorder by reference (token mint, find-or-create release, per-artifact by-reference registration, draft flag cleared). Normalises the /api prefix the pre-fslabscli implementation missed; never touches sling's channel routes, whose alpha/beta/prod set membership cannot express a per-target pointer. - healthcheck: credential-less verification of the published surface; deserializing into the contract types IS the schema validation; digest-verifies every pointed artifact; builds the full report before failing so one run names every problem. - cleanup-drafts: dry-run by default over the legacy asset-free draft backlog; deletes only with --delete after review. Also restores the ops-only shared helpers the core trimmed: http::request/get_to_file/head_present and keyring::fingerprints. cargo test: 324 passed. clippy: zero diagnostics.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
fslabs-bot
Bot
added
the
size/XXL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Objective
Stacks on #336 (the release pipeline core). The operational periphery:
nothing here gates a release shipping; these are the commands operators
and clients use around one.
Solution
release resolverelease recordrelease healthcheckrelease cleanup-draftsAlso restores the ops-only shared helpers the core trimmed
(http::request/get_to_file/head_present, keyring::fingerprints).
Testing
cargo test: 324 passed (the core's 311 plus 13 here).resolve
--download, digest and GPG verification both green; theunpromoted-channel case fails with the exact contract wording.
artifact (names both digests).
Merge after #336; fsl_libs#4230's healthcheck workflow and the publish
job's record step invoke these commands, so the release that sets the
fsl_libs pin should include both PRs.