TudorandClaude Opus 5
0c901cd0d1
PR Checks / Frontend Typecheck + Tests (pull_request) Successful in 1m11s
PR Checks / Backend Smoke (pull_request) Successful in 9s
PR Checks / Build Backend (no push) (pull_request) Successful in 18s
PR Checks / Build Frontend (no push) (pull_request) Successful in 1m19s
PR Checks / Build Pipeline (no push) (pull_request) Successful in 36s
PR Checks / AI Code Review (Claude) (pull_request) Successful in 6m3s
Staging health polling asked only whether something answered HTTP 200 at the base URL. It could not tell the new deployment from the old one, so journeys could pass against the previous release, and concurrent merges could move the staging tags underneath a run in flight. Each staging run now mints a build ID and stamps all three images with the commit and that ID, as labels and — for frontend and backend — as a build-time JSON file that environment overrides cannot rewrite. /release.json reports both identities uncached, and scripts/ci/release.py polls for the expected pair before and after the journeys. Only then are the captured build digests tagged verified-<sha>. Promotion resolves those verified tags to immutable digests, revalidates their labels, and refuses a mixed or incomplete set before any :prod tag moves. The whole staging workflow shares one concurrency group with cancellation disabled, so releases serialise. The scripts are stdlib-only and unit-tested against mocked registry and HTTP behaviour; PR checks now run the pipeline and CI suites too. The runbook records what this cannot prove locally, and that the first rollout needs a commit built by this workflow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
31 lines
1.3 KiB
TypeScript
31 lines
1.3 KiB
TypeScript
/** @jest-environment node */
|
|
import { GET } from '@/app/(frontend)/release.json/route';
|
|
import { readFile } from 'node:fs/promises';
|
|
|
|
jest.mock('node:fs/promises', () => ({ readFile: jest.fn() }));
|
|
const realFetch = global.fetch;
|
|
const identity = { sha: 'a'.repeat(40), build_id: 'b'.repeat(32) };
|
|
beforeEach(() => {
|
|
jest.mocked(readFile).mockResolvedValue(JSON.stringify(identity));
|
|
global.fetch = jest.fn(async () => Response.json(identity));
|
|
});
|
|
afterEach(() => { global.fetch = realFetch; jest.resetAllMocks(); });
|
|
|
|
test('reports immutable file identity and backend identity without caching', async () => {
|
|
const response = await GET();
|
|
expect(response.status).toBe(200);
|
|
expect(response.headers.get('Cache-Control')).toBe('no-store');
|
|
expect(await response.json()).toEqual({ frontend: identity, backend: identity });
|
|
expect(fetch).toHaveBeenCalledWith(expect.stringMatching(/\/api\/release$/), expect.objectContaining({ cache: 'no-store', signal: expect.anything() }));
|
|
});
|
|
|
|
test('missing build metadata cannot pass the release gate', async () => {
|
|
jest.mocked(readFile).mockRejectedValueOnce(new Error('missing file'));
|
|
expect((await GET()).status).toBe(503);
|
|
});
|
|
|
|
test('backend failure cannot pass the release gate', async () => {
|
|
jest.mocked(fetch).mockResolvedValueOnce(new Response('', { status: 503 }));
|
|
expect((await GET()).status).toBe(503);
|
|
});
|