Artifact & Release Governance Pipeline
Multi-stage release pipeline where every promotion is a deliberate, logged gate—artifacts bound to commit and tests, checksummed and env-signed, with storage/network fail-clear behavior and a reconstructable per-release ledger.
StackPython 3 · JSONL audit · file registry · GitHub Actions
Signalsmulti-stage promote · sha256+HMAC · fail-clear · secret proof · release ledger
Requirements outline
Scope this page covers. Each row is an acceptance item the automation targets; delivery is what ships in this revision.
| ID | Requirement | Delivery |
|---|---|---|
| FR1 | Multi-stage multi-env pipeline | build → test → staged → production; promote is deliberate CLI/GHA job |
| FR2 | Artifact integrity | sha256 + HMAC over digest; commit + test_report_id on ledger |
| FR3 | Storage-aware under pressure | storage gate refuse_write; lab RELEASE_SIMULATE_LOW_STORAGE |
| FR4 | Network-resilient registry steps | retries + checksum after copy; no silent success / no status advance |
| FR5 | Security boundary for secrets | env-only signing key; prove-secrets live scan |
| FR6 | Reconstructable audit trail | state/releases + audit.jsonl; reconstruct CLI |
Evidence
Terminal captures from the lab host. Click an image to expand fullscreen.
Problem
I needed a pipeline that could survive an audit question—not just “it built and deployed,” but every shipped artifact traceable to a commit and test run, promotions intentional and logged, and failures that leave state clearly failed rather than half-applied.
Approach
Python release_gov control plane with versioned config/pipeline.json. Stages build → test → promote(staging) → promote(production). Artifacts get SHA-256 + HMAC (key only from RELEASE_SIGNING_KEY). Storage gate refuses writes under pressure; registry push retries then fails clear without advancing status. Approver+reason required on promote; intent logged before push. CLI reconstruct / verify-integrity / prove-secrets for auditors.
Outcomes
- build→test packages app, binds junit report id, status=tested
- Storage-low simulation refuses build with structured gate (recoverable)
- Registry-down mid-promote retries then failed_clear; status stays tested
- Staging+production promotions with approver/reason; identical sha256 store→registry→deploy
- prove-secrets scans ledger/audit/config/artifact — secret never present