feat(promote): guard promotion against diverged environments - #102
Merged
Merged
Conversation
Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
Add three additive preflight guards for hotfix divergence: refuse promotion from a diverged env, require the incoming SHA to contain every recorded patch when promoting into a diverged env (force overrides with a loud warning), and assert the publish path never sources from a diverged env. Guards fire only when divergence fields are present, so manifests without them are unaffected. The git-ancestry checker is injected via a functional option. Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When an environment is pinned to an integration branch carrying out-of-band patches, its recorded SHA is not on trunk. Promotion copies SHAs between env states blindly, so today a diverged env can leak a non-trunk SHA upward, reach the publish path, or be overwritten by an incoming SHA that silently regresses a fix deployed into it.
Fix
Three additive preflight guards, surfaced through the promote preflight so the generated workflow fails before deploy rather than mid-run:
Every guard fires only when divergence fields are present, so a manifest with none exercises zero new code paths. The git-ancestry checker is injected through a functional option (
WithAncestorFunc), keeping required inputs positional and making the patch-containment rule deterministically testable.Verification
go build ./...go test ./internal/promote/... ./internal/orchestrate/...(140 pass)go test ./...(1076 pass)go test -race ./internal/promote/...go vet ./internal/promote/...golangci-lint run ./internal/promote/...All green. Existing promote and preflight tests untouched and passing.