feat(gitea): add package release promotion receipts

scripts/ci/generate-cicd-artifact-receipts.py

@@ -23,6 +23,7 @@ SCHEMA_VERSION = "awoooi_cicd_artifact_receipts_v1"
 SBOM_SCHEMA_VERSION = "awoooi_cicd_sbom_v1"
 PROVENANCE_SCHEMA_VERSION = "awoooi_cicd_provenance_v1"
 RETENTION_SCHEMA_VERSION = "awoooi_cicd_artifact_retention_v1"
+PACKAGE_RELEASE_SCHEMA_VERSION = "awoooi_cicd_package_release_promotion_v1"
 
 PYPROJECT_PATHS = [
     "apps/api/pyproject.toml",
@@ -270,12 +271,53 @@ def build_receipts(repo_root: Path, out_dir: Path) -> dict[str, Any]:
         retention,
     )
 
+    package_release = {
+        "schema_version": PACKAGE_RELEASE_SCHEMA_VERSION,
+        "source_control_authority": "gitea",
+        "release_channel_contract": {
+            "primary_package_registry": "gitea_packages",
+            "container_registry": "registry.wooo.work/awoooi",
+            "release_tag_pattern": "awoooi-api-{short_sha}",
+            "rollback_artifact_pattern": "awoooi-api-{previous_short_sha}",
+            "changelog_receipt_required": True,
+            "sbom_ref_required": True,
+            "provenance_ref_required": True,
+            "deploy_marker_ref_required": True,
+        },
+        "promotion_subject": {
+            "name": "awoooi",
+            "source_sha": source_sha,
+            "run_id": run_id,
+            "run_attempt": run_attempt,
+            "sbom_sha256": sbom_sha,
+            "provenance_sha256": provenance_sha,
+            "artifact_retention_sha256": retention_sha,
+        },
+        "rollback_receipt_contract": {
+            "rollback_source": "previous_deploy_marker",
+            "rollback_requires_image_digest": True,
+            "rollback_requires_package_or_release_ref": True,
+            "rollback_requires_post_apply_readback": True,
+        },
+        "operation_boundaries": {
+            "package_registry_write_attempted": False,
+            "gitea_release_write_attempted": False,
+            "tag_write_attempted": False,
+            "secret_value_read_allowed": False,
+            "github_api_allowed": False,
+        },
+    }
+    package_release_sha = _write_json(
+        out_dir / "awoooi-ci-package-release-promotion.json",
+        package_release,
+    )
+
     manifest = {
         "schema_version": SCHEMA_VERSION,
         "source_control_authority": "gitea",
         "source_sha": source_sha,
         "run_id": run_id,
-        "receipt_count": 3,
+        "receipt_count": 4,
         "receipts": [
             {
                 "id": "sbom",
@@ -292,6 +334,11 @@ def build_receipts(repo_root: Path, out_dir: Path) -> dict[str, Any]:
                 "path": str(out_dir / "awoooi-ci-artifact-retention-manifest.json"),
                 "sha256": retention_sha,
             },
+            {
+                "id": "package_release_promotion",
+                "path": str(out_dir / "awoooi-ci-package-release-promotion.json"),
+                "sha256": package_release_sha,
+            },
         ],
         "ready": True,
         "operation_boundaries": {

scripts/ci/tests/test_generate_cicd_artifact_receipts.py

@@ -76,9 +76,21 @@ dev = ["pytest>=8"]
             encoding="utf-8"
         )
     )
+    package_release = json.loads(
+        (out_dir / "awoooi-ci-package-release-promotion.json").read_text(
+            encoding="utf-8"
+        )
+    )
 
     assert manifest["schema_version"] == "awoooi_cicd_artifact_receipts_v1"
     assert manifest["ready"] is True
+    assert manifest["receipt_count"] == 4
+    assert [receipt["id"] for receipt in manifest["receipts"]] == [
+        "sbom",
+        "provenance",
+        "artifact_retention",
+        "package_release_promotion",
+    ]
     assert manifest["operation_boundaries"] == {
         "secret_values_collected": False,
         "github_api_used": False,
@@ -97,3 +109,24 @@ dev = ["pytest>=8"]
     assert (
         retention["operation_boundaries"]["package_registry_write_attempted"] is False
     )
+    assert (
+        package_release["schema_version"] == "awoooi_cicd_package_release_promotion_v1"
+    )
+    assert (
+        package_release["release_channel_contract"]["primary_package_registry"]
+        == "gitea_packages"
+    )
+    assert (
+        package_release["rollback_receipt_contract"][
+            "rollback_requires_post_apply_readback"
+        ]
+        is True
+    )
+    assert (
+        package_release["operation_boundaries"]["package_registry_write_attempted"]
+        is False
+    )
+    assert (
+        package_release["operation_boundaries"]["gitea_release_write_attempted"]
+        is False
+    )