way/pigway-frame-flow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 29 Wiki Activity

fix: verify full prebuilt images before offline production deployment
Community checks / verify (push) Skipped
Details
Verify Frame Flow / verify (push) Successful in 5m37s
Details

Browse Source
This commit is contained in:
渡口浪人
2026-10-18 19:45:30 +08:00
parent cb8ac32b74
commit 50bb41899d
5 changed files with 121 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/BUILDING.md
+4
View File
@@ -81,3 +81,7 @@ If dependency installation fails, the always() cleanup step still executes.
It skips the Python/PyYAML cleanup script when no CI Compose manifest exists,
as no Docker verification resources have been created at that point.
### Verified prebuilt production image
When the production host cannot reach the registry, build the complete Dockerfile in a trusted build environment and transfer it with `docker image save` / `docker image load`. Supply the immutable `sha256:` image ID privately as `FRAME_FLOW_PREBUILT_IMAGE_ID` to `scripts/server-release.py`. The expected version/commit tag must already exist. The script checks the ID, version and revision labels, then verifies runtime source and license hashes in an isolated container without production mounts before switching the service. Existing storage checks, backups, post-deployment verification and rollback remain in effect.