HH-443: establish production CI and supply-chain evidence (#93)

* ci: enforce production release gates * ci: close release gate review blockers * ci: preserve verified digests during promotion * ci: serialize and verify release cleanup * ci: build govulncheck with Shangwutong toolchain --------- Co-authored-by: Rogee <rogee@ipao.vip>
2026-08-22 03:26:38 +08:00
parent 798ea43c2f
commit 02a188dc29
17 changed files with 483 additions and 89 deletions
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+delete_package_version() {
+  local endpoint=$1 tag=$2 digest=$3 attempt versions version_id
+  local retries=${RELEASE_RETRY_COUNT:-5} delay=${RELEASE_RETRY_DELAY:-2}
+
+  for ((attempt = 1; attempt <= retries; attempt++)); do
+    if versions=$(gh api --paginate --slurp "$endpoint?per_page=100") &&
+      version_id=$(jq -er --arg tag "$tag" --arg digest "$digest" \
+        '[.[][] | select(.name == $digest and ((.metadata.container.tags // []) | index($tag)))] | if length == 1 then .[0].id else empty end' \
+        <<< "$versions") &&
+      [[ $version_id =~ ^[0-9]+$ ]] &&
+      gh api --method DELETE "$endpoint/$version_id"; then
+      return 0
+    fi
+    ((attempt == retries)) || sleep "$delay"
+  done
+
+  echo "Could not delete package version for $tag at $digest" >&2
+  return 1
+}
+
+wait_for_tag_absent() {
+  local target=$1 attempt output
+  local retries=${RELEASE_RETRY_COUNT:-5} delay=${RELEASE_RETRY_DELAY:-2}
+
+  for ((attempt = 1; attempt <= retries; attempt++)); do
+    if output=$(crane digest "$target" 2>&1); then
+      :
+    elif grep -Eiq 'MANIFEST_UNKNOWN|manifest unknown|not found|404' <<< "$output"; then
+      return 0
+    fi
+    ((attempt == retries)) || sleep "$delay"
+  done
+
+  [[ -z $output ]] || printf '%s\n' "$output" >&2
+  echo "Tag still resolves after cleanup: $target" >&2
+  return 1
+}