wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(api): fail closed on stale production runtime deploy readback
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-30 18:55:15 +08:00
parent 12c1811e50
commit 76fee33e1b
5 changed files with 112 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/api/src/services/awoooi_production_deploy_readback_blocker.py
View File

@@ -135,7 +135,11 @@ def _enrich_runtime_build_readback(payload: dict[str, Any]) -> None:
readback["desired_main_api_image_tag_readback_status"] = "ok"
readback["desired_main_api_image_tag_sha"] = desired_tag
readback["desired_main_api_image_tag_short_sha"] = desired_tag[:10]
image_matches_main = build_sha == desired_tag
image_matches_main = (
build_sha == desired_tag
and source_matches_runtime
and image_matches_runtime
)
readback["production_image_tag_matches_main"] = image_matches_main
rollups["source_control_main_ready"] = True
rollups["production_image_tag_matches_main"] = image_matches_main

13
apps/api/tests/test_awoooi_production_deploy_readback_blocker.py
View File

@@ -5,7 +5,7 @@ from src.services import awoooi_production_deploy_readback_blocker as service
_COMMITTED_SNAPSHOT_SHA = "a70c6756d9e76c33143676eef82bab7a49ac1839"
def test_production_deploy_readback_verifies_runtime_build_against_gitops_desired(
def test_production_deploy_readback_blocks_stale_source_even_when_gitops_desired_matches_runtime(
monkeypatch,
):
build_sha = "0123456789abcdef0123456789abcdef01234567"
@@ -33,10 +33,13 @@ def test_production_deploy_readback_verifies_runtime_build_against_gitops_desire
assert readback["desired_main_api_image_tag_sha"] == build_sha
assert readback["desired_main_api_image_tag_source"] == "gitops_deployment_env"
assert readback["desired_main_api_image_tag_readback_status"] == "ok"
assert readback["production_image_tag_matches_main"] is True
assert payload["status"] == "closure_verified"
assert rollups["production_image_tag_matches_main"] is True
assert rollups["hard_blocker_count"] == 0
assert readback["production_image_tag_matches_main"] is False
assert payload["status"] == "blocked_production_runtime_image_tag_not_verified"
assert rollups["production_image_tag_matches_main"] is False
assert rollups["hard_blocker_count"] == 1
assert "production_runtime_image_tag_does_not_match_gitea_main_desired_tag" in (
payload["blockers"]
)
def test_production_deploy_readback_keeps_committed_snapshot_evidence(monkeypatch):