ci: reuse candidates for production pull requests
Platform CI tests / QuickStack deploy action tests (push) Successful in 27s
Nuvisphere/Platform-CI: Immutable QuickStack OCI deployment / Build once and deploy exact digest (push) Successful in 28s

This commit is contained in:
2026-08-20 16:30:23 +02:00
parent a4247d2697
commit f4ffb28018
3 changed files with 91 additions and 6 deletions
+2 -2
View File
@@ -73,7 +73,7 @@ Use manifest version 2 when one image serves multiple applications or Production
"name": "production",
"branch": "prod",
"strategy": "promote",
"source": { "mergeParent": 2, "requireTreeMatch": true },
"source": { "branch": "staging", "mergeParent": 2, "requireTreeMatch": true },
"release": {
"versionFile": "content/releases/latest.json",
"notesFile": "content/releases/$version.md",
@@ -87,4 +87,4 @@ Use manifest version 2 when one image serves multiple applications or Production
}
```
Candidate pipelines build every artifact once, push `sha-<commit>`, resolve the registry digest and deploy applications in dependency order. Promotion pipelines require a merge parent with an identical Git tree, pull the existing candidate, verify required container files, add the SemVer alias, deploy the exact digests, create the immutable tag and publish the canonical Gitea release. Tag creation does not trigger another scoped pipeline because the workflow listens only to branch pushes.
Candidate pipelines build every artifact once, push `sha-<commit>`, resolve the registry digest and deploy applications in dependency order. A pull request into a promotion branch must originate from `source.branch`; it pulls and verifies the already tested `sha-<commit>` candidates without rebuilding or deploying them. Promotion pushes require a merge parent with an identical Git tree, pull the existing candidate, verify required container files, add the SemVer alias, deploy the exact digests, create the immutable tag and publish the canonical Gitea release. Tag creation does not trigger another scoped pipeline because the workflow listens only to branch pushes.