docs: freeze cicd special-case boundaries

This commit is contained in:
Codex
2026-05-20 03:39:52 +00:00
parent 595de3d320
commit e28cc6ba2d
7 changed files with 93 additions and 6 deletions
+1 -1
View File
@@ -217,4 +217,4 @@ The deploy job is not complete until live verification proves the running servic
## Unsupported Services
Image-only services, such as a service declared directly as `docker.io/vendor/image:tag` without a Dockerfile source artifact, do not satisfy target-side build policy. They must be converted to a source repository with a Dockerfile wrapper before the reconciler can manage them. Until then, `deploy check` and `deploy plan` should report them as unsupported.
Image-only services, such as a service declared directly as `docker.io/vendor/image:tag` without a Dockerfile source artifact, do not satisfy target-side source-build policy. They must not be silently converted into Dockerfile source builds. If the object is an approved upstream image exception, it must follow the digest-pinned pull-only model documented in `docs/reference/cicd-standardization.md`; otherwise `deploy check`, `deploy plan` and CD entrypoints should report it as unsupported until a reviewed artifact producer or upstream digest consumer exists.