Gate Driver release metadata on completed Play production - #402
Open
OziinG wants to merge 1 commit into
Open
Conversation
Constraint: Preserve existing app response fields and minimum support without a schema or app change. Rejected: Treat upload or review approval as live availability | Neither proves completed production rollout. Rejected: Reuse an interactive Play token | Opening an edit can invalidate that user's other edit. Confidence: high Scope-risk: narrow Directive: Bind APK metadata to the exact artifact in the trusted release producer; this gate verifies Play publication and rollout only. Tested: API suite 2311 passed; 31 targeted release and credential tests; lint, typecheck, build, secret scan; independent review approved. Not-tested: Dedicated live Play credential exchange and release producer integration are not configured; no production publication or registry update executed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Driver registry can lag behind Play and a concurrent publisher can overwrite a newer release or support policy. This adds an opt-in publication check to the existing release producer command and guards updates against the previously read registry state.
Play synchronization requires both a published lifecycle and a fresh completed production track. Drafts, pending review, managed-publishing queues, partial/halted rollouts and API failures prevent the registry write. The minimum supported version is preserved. Temporary edits use only the configured dedicated service-account identity; generic user-token fallback is excluded.
The trusted producer still supplies the exact APK version/name/digest. This PR does not fabricate APK metadata, change the response contract, migrate the database, install credentials, schedule jobs or wire a release trigger. It prepares the gated entry point; automatic synchronization remains inactive until the release producer and dedicated Play access are configured and verified. The one-time current-version correction is a separate conditional settings operation and is now specified against an existing Play-signed vc21 APK verified locally for package/version/signature and SHA-256. No settings write has occurred.
Validation: API suite 2311 passed with 124 environment-dependent skips; 31 targeted release/credential cases passed, including real fixture RSA signature verification and CLI refusal of generic tokens before database access. Prisma generation, lint (initial test-fixture findings fixed and affected files rechecked), typecheck, build and secret scanning passed. Independent source review approved with no remaining findings. No real credential exchange, Play edit, production deployment or registry write was performed.
Based on production baseline
3bb31dd84ac23109ce51caabd72c43186ddea493; excludes Shopify PR401. Deployment and the current vc21 configuration correction remain under the DSV release coordinator's exact-target instructions.Exact-head CI passed: https://github.com/EVNSolution/clever-route-server/actions/runs/34209000270 (
6cc7645a6b2ad74fa6025c044419c91c2bf55dbf).