1.5 KiB
Deployment evidence contract
A UAT run binds to one immutable deployment tuple:
application_commit
image_digests
GitOps_commit
ArgoCD_application
ArgoCD_sync_revision
cluster_environment
base_url
The template commit is provenance, not the deployed revision. Resolve the rendered desired-state repository and environment from the handoff; a production revision cannot substitute for the declared non-production deployment.
Read live identity and health before and after execution, retaining both timestamped snapshots. For app-of-apps or multi-source deployments, record root and runtime controller identities separately: compare the root to the rendered Git revision and each child/source to its declared chart version or source revision, not blindly to the same Git SHA. Require synchronized, healthy state and compare pod image IDs plus exposed source/chart annotations or version endpoints to the immutable artifacts in the handoff.
Reject the handoff when:
- an image tag is mutable and no digest is supplied;
- Argo CD reports
OutOfSync,Unknown,Degraded, or another non-healthy state; - the deployed source cannot be correlated to the handoff;
- the base URL resolves to a different environment;
- a newer synchronization occurs after the run begins.
If deployment identity changes during execution, end the run as invalidated and start a new run after the new identity is frozen; never combine results across deployment tuples. Missing post-run identity or health evidence blocks a release-facing pass.