TASK: Implement digest-based artifact promotion gates #63

New Issue

darkhelm · 2026-06-17T19:31:56-04:00

darkhelm commented

2026-06-17 19:31:56 -04:00

Summary

Enforce immutable digest-based promotion so only validated image digests are eligible for downstream deployment.

Problem

Tag-based flows can drift. Promotion must be bound to validated immutable digests.

Scope

Capture backend and frontend digests at build/validation completion.
Persist digest metadata in workflow outputs/artifacts.
Gate promotion logic on validated digests only.
Prevent post-validation rebuild in release path.

Out of Scope

Environment-specific deployment details.
Rollback automation UX.

Acceptance Criteria

Promotion input references immutable digests.
Workflow records digest provenance for each validated artifact.
Promotion is blocked if digest provenance is missing or invalid.
No rebuild step exists after validation success.

Dependencies

Issues:

Split CI tooling environment from deployable runtime images
Establish source-level fast-check lane
Add post-build black-box integration tests against runtime containers
Run browser E2E from dedicated runner image against runtime services

Definition of Done

Artifact promotion path is digest-locked and provenance-aware.

## Summary Enforce immutable digest-based promotion so only validated image digests are eligible for downstream deployment. ## Problem Tag-based flows can drift. Promotion must be bound to validated immutable digests. ## Scope 1. Capture backend and frontend digests at build/validation completion. 2. Persist digest metadata in workflow outputs/artifacts. 3. Gate promotion logic on validated digests only. 4. Prevent post-validation rebuild in release path. ## Out of Scope 1. Environment-specific deployment details. 2. Rollback automation UX. ## Acceptance Criteria 1. Promotion input references immutable digests. 2. Workflow records digest provenance for each validated artifact. 3. Promotion is blocked if digest provenance is missing or invalid. 4. No rebuild step exists after validation success. ## Dependencies Issues: - Split CI tooling environment from deployable runtime images - Establish source-level fast-check lane - Add post-build black-box integration tests against runtime containers - Run browser E2E from dedicated runner image against runtime services ## Definition of Done Artifact promotion path is digest-locked and provenance-aware.

darkhelm referenced this issue

2026-06-17 19:37:57 -04:00

EPIC: Separate deployable runtime images from CI validation environments #66

darkhelm added a new dependency 2026-06-17 19:38:57 -04:00

#66 EPIC: Separate deployable runtime images from CI validation environments

darkhelm changed title from ~~Implement digest-based artifact promotion gates~~ to TASK: Implement digest-based artifact promotion gates

2026-06-18 11:55:51 -04:00

darkhelm added the ops label 2026-06-18 11:57:12 -04:00

darkhelm added this to the E10 - Separate deployable runtime images from CI milestone 2026-06-18 11:58:10 -04:00

darkhelm added this to the Main Project Board project 2026-06-18 11:59:02 -04:00

copilotcoder was assigned by darkhelm

2026-06-18 11:59:33 -04:00