fix: isolate staging deployment control
Deploy staging to test server / deploy (push) Successful in 2m27s

Make staging migration, deployment, and maintenance workflows use the staging branch exclusively so test delivery no longer depends on or modifies production main.
This commit is contained in:
linmeng
2026-07-30 10:17:50 +08:00
parent d44a41408b
commit 85ae00f391
8 changed files with 26 additions and 31 deletions
@@ -193,11 +193,12 @@ test("deploy and migration consume the exact successful gate artifact", () => {
}
});
test("main owns the deployment control plane and target revisions are data only", () => {
test("staging owns its deployment control plane independently from main", () => {
for (const workflow of [read(deployWorkflow), read(migrationWorkflow)]) {
assert.match(workflow, /name: Checkout trusted main controller[\s\S]*ref: main/);
assert.match(workflow, /name: Checkout staging controller[\s\S]*ref: staging/);
assert.match(workflow, /fetch-depth: 0/);
assert.match(workflow, /git merge-base --is-ancestor "\$DEPLOY_SHA" HEAD/);
assert.doesNotMatch(workflow, /ref: main/);
assert.doesNotMatch(workflow, /reviewed main history/);
assert.match(workflow, /--include='\/deploy\/' --include='\/deploy\/\*\*\*' --exclude='\*'/);
assert.doesNotMatch(workflow, /ref: \$\{\{ steps\.revision\.outputs\.sha \}\}/);
}