chore: add cicd legacy cleanup precheck

2026-05-20 00:27:51 +00:00
parent fced0520fe
commit 240ff7bdb1
18 changed files with 283 additions and 12 deletions
@@ -41,6 +41,66 @@
      "volumes"
    ]
  },
+  "upstreamImageConsumers": [
+    {
+      "serviceId": "filebrowser",
+      "source": "upstream-image",
+      "upstreamImageRef": "docker.io/filebrowser/filebrowser:v2.63.3",
+      "upstreamSourceRepo": "https://github.com/filebrowser/filebrowser",
+      "upstreamSourceRevision": "ca5e249e3c0c94159c2136a0cd431a424eb18472",
+      "digestPin": {
+        "required": true,
+        "status": "pending-network-verification",
+        "expectedRefShape": "docker.io/filebrowser/filebrowser@sha256:<manifest-digest>"
+      },
+      "mirrorStrategy": {
+        "mode": "mirror-after-digest-verification",
+        "targetRepository": "127.0.0.1:5000/upstream/filebrowser/filebrowser",
+        "targetDigestRefShape": "127.0.0.1:5000/upstream/filebrowser/filebrowser@sha256:<manifest-digest>"
+      },
+      "ciBuild": {
+        "dockerfileBuild": false,
+        "publishCommand": null,
+        "reason": "third-party upstream image; CD may only pull a verified digest or mirror digest"
+      },
+      "pullOnlyCdValidation": [
+        "resolve tag to upstream manifest digest before mirroring or rollout",
+        "pull by digest or from the digest-verified local mirror",
+        "verify container image id/digest and OCI labels report filebrowser 2.63.3 / ca5e249e3c0c94159c2136a0cd431a424eb18472",
+        "verify provider-private File Browser health through the UniDesk microservice proxy",
+        "do not run docker build, docker compose up --build, or a CI Dockerfile producer"
+      ]
+    },
+    {
+      "serviceId": "filebrowser-d601",
+      "source": "upstream-image",
+      "upstreamImageRef": "docker.io/filebrowser/filebrowser:v2.63.3",
+      "upstreamSourceRepo": "https://github.com/filebrowser/filebrowser",
+      "upstreamSourceRevision": "ca5e249e3c0c94159c2136a0cd431a424eb18472",
+      "digestPin": {
+        "required": true,
+        "status": "pending-network-verification",
+        "expectedRefShape": "docker.io/filebrowser/filebrowser@sha256:<manifest-digest>"
+      },
+      "mirrorStrategy": {
+        "mode": "mirror-after-digest-verification",
+        "targetRepository": "127.0.0.1:5000/upstream/filebrowser/filebrowser",
+        "targetDigestRefShape": "127.0.0.1:5000/upstream/filebrowser/filebrowser@sha256:<manifest-digest>"
+      },
+      "ciBuild": {
+        "dockerfileBuild": false,
+        "publishCommand": null,
+        "reason": "third-party upstream image; CD may only pull a verified digest or mirror digest"
+      },
+      "pullOnlyCdValidation": [
+        "resolve tag to upstream manifest digest before mirroring or rollout",
+        "pull by digest or from the digest-verified local mirror",
+        "verify container image id/digest and OCI labels report filebrowser 2.63.3 / ca5e249e3c0c94159c2136a0cd431a424eb18472",
+        "verify provider-private File Browser health through the UniDesk microservice proxy",
+        "do not run docker build, docker compose up --build, or a CI Dockerfile producer"
+      ]
+    }
+  ],
  "artifacts": [
    {
      "serviceId": "baidu-netdisk",