orchestrator

admin/orchestrator

Fork 0

Commit Graph

Author	SHA1	Message	Date
Dev Agent	f0c2986477	ORCH-058: implement fail-closed provenance guard in deploy-hook + GIT_SHA OCI label in Dockerfile All checks were successful CI / test (push) Successful in 16s Details - deploy-hook: REVISION_LABEL/EXPECTED_REVISION (default unset -> backward-compat) - deploy-hook: fail-closed guard inspects SOURCE_IMAGE revision label before docker tag, normalises <no value>, exit 1 on empty/mismatch - deploy-hook: new --build-staging mode rebuilds staging image stamping GIT_SHA - Dockerfile: ARG GIT_SHA + LABEL org.opencontainers.image.revision=$GIT_SHA Closes TC07/TC08 (tests/test_deploy_hook_provenance.py).	2026-06-07 11:20:38 +03:00
claude-bot	10f2a39a58	feat(deploy): build-once SOURCE_IMAGE retag in hook + deploy-stage docs Add the optional, backward-compatible SOURCE_IMAGE branch to orchestrator-deploy-hook.sh: when set, retag the staging-validated image onto TARGET_IMAGE (docker tag) before `up -d --no-build` instead of rebuilding — guarantees prod runs the exact artefact that passed staging (AC-7 / TC-14). Unset -> prior behaviour; exit-code contract (0/1/2) and health-loop untouched. Update golden-source docs (AC-13): rewrite deployer.md `deploy` stage from "paper SUCCESS" to the executable self-deploy (Phase A/B/C, no self-restart from inside the container) and add the ORCH-036 CHANGELOG entry. Refs: ORCH-036 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-06 21:07:35 +00:00
Dev Agent	a6cbacb62c	feat(staging): add orchestrator deploy hook with health-check and auto-rollback (ORCH-34) All checks were successful CI / test (push) Successful in 13s Details CI / test (pull_request) Successful in 9s Details	2026-06-05 09:26:12 +03:00

Author

SHA1

Message

Date

Dev Agent

f0c2986477

ORCH-058: implement fail-closed provenance guard in deploy-hook + GIT_SHA OCI label in Dockerfile

CI / test (push) Successful in 16s

Details

- deploy-hook: REVISION_LABEL/EXPECTED_REVISION (default unset -> backward-compat)
- deploy-hook: fail-closed guard inspects SOURCE_IMAGE revision label before docker tag, normalises <no value>, exit 1 on empty/mismatch
- deploy-hook: new --build-staging mode rebuilds staging image stamping GIT_SHA
- Dockerfile: ARG GIT_SHA + LABEL org.opencontainers.image.revision=$GIT_SHA

Closes TC07/TC08 (tests/test_deploy_hook_provenance.py).

2026-06-07 11:20:38 +03:00

claude-bot

10f2a39a58

feat(deploy): build-once SOURCE_IMAGE retag in hook + deploy-stage docs

Add the optional, backward-compatible SOURCE_IMAGE branch to
orchestrator-deploy-hook.sh: when set, retag the staging-validated image
onto TARGET_IMAGE (docker tag) before `up -d --no-build` instead of
rebuilding — guarantees prod runs the exact artefact that passed staging
(AC-7 / TC-14). Unset -> prior behaviour; exit-code contract (0/1/2) and
health-loop untouched.

Update golden-source docs (AC-13): rewrite deployer.md `deploy` stage from
"paper SUCCESS" to the executable self-deploy (Phase A/B/C, no self-restart
from inside the container) and add the ORCH-036 CHANGELOG entry.

Refs: ORCH-036

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-06-06 21:07:35 +00:00

Dev Agent

a6cbacb62c

feat(staging): add orchestrator deploy hook with health-check and auto-rollback (ORCH-34)

CI / test (push) Successful in 13s

Details

CI / test (pull_request) Successful in 9s

Details

2026-06-05 09:26:12 +03:00

3 Commits