Retain current production image and one rollback baseline

2026-10-11 09:14:23 +08:00
parent 80c6bf3b7d
commit 327fa53d7b
3 changed files with 114 additions and 0 deletions
@@ -363,3 +363,16 @@ the audit client's normal HTTP freshness rules. It is not a permanent offline
 snapshot or a cross-job cache. Raw network exceptions are omitted because proxy
 URLs may contain credentials. Logs identify the advisory host and whether the
 complete audit succeeded.
+
+### Production image retention
+
+After a deployment passes verification and its success journal is saved, Frame Flow
+removes obsolete `release-<commit>-<owner>` and `rollback-<owner>` images from the
+configured production image repository. It retains the running version and the
+previous deployment baseline for one-step rollback. Images referenced by any
+container (including stopped containers), images with unrelated tags, and CI
+images are protected. Retention does not prune build cache, volumes, or data.
+Failed deployments do not run retention; cleanup failure produces a warning and
+never rolls back a successfully verified deployment. Historical deployment
+journals remain available for audit, but only the latest rollback image is
+retained locally; older releases require rebuilding before use.