root/Jyotisha
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(staging): let migrate accept docs-only-ahead like deploy
Independent Staging Quality Gate / validate (push) Successful in 8m57s
Details
Independent Staging Quality Gate / publish (push) Successful in 1m49s
Details

Browse Source 
Docs-only staging HEAD blocked Migrate Staging Database even when an ancestor already had a successful exact-SHA gate, so pending SQL could not be applied.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jesse_Chen
2026-09-03 10:28:59 +08:00
parent 1d77b5b129
commit 13bde020fb
3 changed files with 73 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/tests/staging-backend-workflows.test.ts
+22 -1
View File
@@ -689,7 +689,10 @@ test("Gitea migration remains manual and consumes only the gate-pinned web image
assert.match(workflow, /^on:\n\s+workflow_dispatch:/m);
assert.doesNotMatch(workflow, /workflow_run:|\n\s+push:/);
assert.match(workflow, /concurrency:\n\s+group: staging-mutation\n\s+cancel-in-progress: false\n\s+queue: max/);
assert.match(workflow, /migration requires current staging head/);
assert.doesNotMatch(workflow, /migration requires current staging head/);
assert.match(workflow, /deferring the docs-only range check to the attested controller/);
assert.match(workflow, /head_check=\$head_check/);
assert.match(workflow, /no successful exact-SHA staging quality gate run found/);
assert.doesNotMatch(workflow, /read_ref_sha main|refs\/heads\/main|reviewed main/);
assert.doesNotMatch(workflow, /--deepen=/);
assert.match(workflow, /staging advanced during migration; refusing stale mutation/);
@@ -697,6 +700,17 @@ test("Gitea migration remains manual and consumes only the gate-pinned web image
assert.doesNotMatch(workflow, /API_IMAGE:/);
assert.match(workflow, /run-staging-migration\.sh/);
assert.doesNotMatch(workflow, /run-staging-deploy\.sh/);
assertOrder(workflow, [
"Validate current staging revision and successful gate",
"deferring the docs-only range check to the attested controller",
"head_check=$head_check",
"Download gate-produced migration manifest",
"Validate gate-attested controller and digest-pinned migration image",
"Refuse stale staging revision unless only docs advanced",
"stale staging revision refused; migrate the current gated SHA",
"Apply digest-pinned migration under host lock",
"staging advanced during migration; refusing stale mutation",
]);
});
test("Gitea staging mutations use deploy-owned temporary paths", () => {
@@ -1369,6 +1383,7 @@ test("gated paths cover every image input, package input, and gate-read reposito
test("publish dispatch and staging deploy accept docs-only advances only through the attested checker", () => {
const quality = read(giteaQualityWorkflow);
const deploy = read(giteaDeployWorkflow);
const migrate = read(giteaMigrationWorkflow);
const dispatch = quality.match(/- name: Dispatch exact-SHA staging deployment[\s\S]*?(?=\n\s+- name: Logout ACR registry)/)?.[0] ?? "";
assert.match(dispatch, /if \[\[ "\$current_staging_sha" != "\$DEPLOY_SHA" \]\]; then/);
@@ -1399,6 +1414,12 @@ test("publish dispatch and staging deploy accept docs-only advances only through
assert.match(deploy, /if \[\[ "\$allow_rollback" == true && "\$REQUESTED_SHA" != "\$staging_head" \]\]; then\n\s+comparison="\$\(curl/);
assert.match(deploy, /rollback revision is not in current staging history/);
assert.doesNotMatch(deploy, /if \[\[ "\$allow_rollback" == false && "\$REQUESTED_SHA" != "\$staging_head" \]\]; then\n\s+echo "stale staging revision refused/);
assert.match(migrate, /checker=artifacts\/staging-image\/extracted\/deploy\/is-docs-only-range\.sh\n\s+\[\[ -f "\$checker" \]\] \|\| \{ echo "gate-attested controller bundle lacks deploy\/is-docs-only-range\.sh/);
assert.match(migrate, /if bash "\$checker" --api "\$DEPLOY_SHA" "\$staging_head"; then/);
assert.match(migrate, /\[\[ "\$current_head" == "\$DEPLOY_SHA" \]\] && return\n[^\n]*\n\s+bash artifacts\/staging-image\/extracted\/deploy\/is-docs-only-range\.sh --api "\$DEPLOY_SHA" "\$current_head" \|\|\n\s+\{ echo "staging advanced during migration; refusing stale mutation"/);
assert.equal((migrate.match(/is-docs-only-range\.sh/g) ?? []).length, 5);
assert.doesNotMatch(migrate, /bash deploy\/is-docs-only-range\.sh/);
});
test("is-docs-only-range.sh decides from local history and refuses non-ancestor ranges", () => {