From 378d867e9c58ec2dc77c3ec14ff49720e9b2897b Mon Sep 17 00:00:00 2001 From: ogt Date: Tue, 14 Jul 2026 19:29:43 +0800 Subject: [PATCH] fix(cd): allow bounded rollout convergence --- .gitea/workflows/cd.yaml | 12 +++++++----- .../tests/test_executor_network_policy_boundary.py | 12 ++++++++++++ 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml index bfca0dcef..ef0f9a6ed 100644 --- a/.gitea/workflows/cd.yaml +++ b/.gitea/workflows/cd.yaml @@ -3083,11 +3083,13 @@ jobs: sleep 5 done - # 確認 rollout 完成 - $KUBECTL rollout status deployment/awoooi-api -n awoooi-prod --timeout=120s - $KUBECTL rollout status deployment/awoooi-web -n awoooi-prod --timeout=120s - $KUBECTL rollout status deployment/awoooi-worker -n awoooi-prod --timeout=120s - $KUBECTL rollout status deployment/awoooi-ansible-executor-broker -n awoooi-prod --timeout=120s + # Two-replica rollouts can legitimately need more than two minutes + # before the second replacement is available. Keep this bounded, but + # do not abort before the independent boundary verifier can run. + $KUBECTL rollout status deployment/awoooi-api -n awoooi-prod --timeout=300s + $KUBECTL rollout status deployment/awoooi-web -n awoooi-prod --timeout=300s + $KUBECTL rollout status deployment/awoooi-worker -n awoooi-prod --timeout=300s + $KUBECTL rollout status deployment/awoooi-ansible-executor-broker -n awoooi-prod --timeout=300s echo "✅ 部署完成" # AIA-P0-011: production must prove that the public API cannot mutate diff --git a/apps/api/tests/test_executor_network_policy_boundary.py b/apps/api/tests/test_executor_network_policy_boundary.py index 668ab3cff..c33c0ac68 100644 --- a/apps/api/tests/test_executor_network_policy_boundary.py +++ b/apps/api/tests/test_executor_network_policy_boundary.py @@ -224,6 +224,18 @@ def test_cd_concurrency_probe_degrades_to_terminal_false_receipt() -> None: assert "workload DB identity/budget remains in progress" in workflow +def test_cd_allows_bounded_rollout_convergence_before_boundary_verifier() -> None: + repo_root = Path(__file__).resolve().parents[3] + workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text() + rollout_gate = workflow.split("# Two-replica rollouts", 1)[1].split( + "# AIA-P0-011:", 1 + )[0] + + assert rollout_gate.count("--timeout=300s") == 4 + assert "--timeout=120s" not in rollout_gate + assert "independent boundary verifier" in rollout_gate + + def test_broker_probe_accepts_partial_live_route_evidence(tmp_path: Path) -> None: result = _run_broker_probe( tmp_path,