From 79e3506e523ea25928784eddb0ce42690495c952 Mon Sep 17 00:00:00 2001
From: Josh Sokol <josh@simplerisk.com>
Date: Wed, 30 Sep 2026 15:26:07 -0500
Subject: [PATCH] ci: refuse promoting the test feed branch into prod

The two feed branches differ on purpose and prod has a single writer, so merging
updates-test into updates.simplerisk.com overwrites GA bundle checksums and adds
hops for RCs that never shipped (#140, attempted again in #144). Add a check that
fails a same-repo PR from updates-test into prod, and a README documenting the
topic-branch path for one-off prod changes (#139, #145).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/block-test-promotion.yml | 44 ++++++++++++++++++++++
 README.md                                  | 29 ++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 .github/workflows/block-test-promotion.yml
 create mode 100644 README.md

diff --git a/.github/workflows/block-test-promotion.yml b/.github/workflows/block-test-promotion.yml
new file mode 100644
index 0000000..1d3b7ff
--- /dev/null
+++ b/.github/workflows/block-test-promotion.yml
@@ -0,0 +1,44 @@
+name: Block test-branch promotion
+
+# updates-test.simplerisk.com and updates.simplerisk.com are NOT meant to
+# converge. They differ on purpose:
+#   - the testing pipeline retracts unpromoted RCs, keeps their upgrade hops, and
+#     blanks bundle_sha256 for bundles the test channel no longer serves;
+#   - the prod feed has a single writer (update_feeds.sh in sync_code_repo.yml)
+#     that records the real GA asset hashes.
+# Merging the test branch into prod therefore replaces GA truth with RC truth.
+# That happened on 2026-08-21 (#140, fixed by #141) and was attempted again in
+# #144; simplerisk/docker fails closed on the resulting checksum mismatch.
+#
+# Validate feed catches some of the damage after the fact. This refuses the
+# promotion path itself. To change the prod feed by hand (VM digests, a fix),
+# use a topic branch off updates.simplerisk.com, as #139 and #145 did.
+#
+# Make this a REQUIRED status check on the prod ruleset only. It only runs on PRs
+# into prod, so it must not be required on the test branch. Admins can still
+# bypass a required check; that is a deliberate act, not an accident.
+
+on:
+  pull_request:
+    branches: [updates.simplerisk.com]
+
+permissions:
+  contents: read
+
+jobs:
+  block_test_promotion:
+    name: Block test-branch promotion into prod
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse a head branch that is the test feed
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          BASE_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          if [ "$HEAD_REPO" = "$BASE_REPO" ] && [ "$HEAD_REF" = "updates-test.simplerisk.com" ]; then
+            echo "::error title=Do not promote the test feed::This PR merges updates-test.simplerisk.com into the prod feed, which would overwrite GA bundle checksums and add upgrade hops for RCs that never shipped. Open a topic branch off updates.simplerisk.com containing only the change you need (see README.md)."
+            exit 1
+          fi
+          echo "head '$HEAD_REF' is not the test feed branch"
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..f39039f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,29 @@
+# updates.simplerisk.com
+
+Two long-lived branches, one per update channel:
+
+| Branch | Channel | Written by |
+|---|---|---|
+| `updates.simplerisk.com` | GA (prod) | `update_feeds.sh` in `sync_code_repo.yml`, with the real GA asset hashes |
+| `updates-test.simplerisk.com` | testing | `update_feeds.sh` in `publish-bundle.yml`, plus the RC retraction step |
+
+**The branches are not meant to converge. Do not merge one into the other.**
+They differ on purpose: the test feed keeps hops for withdrawn RCs and blanks
+checksums for bundles `bundles-test` no longer serves, while prod records real GA
+hashes. Merging `updates-test` into prod overwrites GA truth with RC truth, and
+`simplerisk/docker` fails closed on the resulting checksum mismatch. The
+`Block test-branch promotion` check refuses that PR.
+
+## Making a change to the prod feed by hand
+
+For one-off changes such as VM appliance digests:
+
+1. Branch off `updates.simplerisk.com`.
+2. Change only the values you mean to (for VM digests, the four
+   `virtualbox_*` / `vmware_*` values of that release).
+3. `python3 scripts/validate_feed.py prod`
+4. Open a PR into `updates.simplerisk.com`. `Validate feed against its channel`
+   must pass.
+
+If the same values belong on the test feed, make a separate change there. See #139
+and #145 for worked examples.