From 0003bfa05cac1238b8f372fe1d10ea6f1ceab2e7 Mon Sep 17 00:00:00 2001 From: yuqei Date: Mon, 20 Jul 2026 19:18:47 +0800 Subject: [PATCH] ci: use validated pip mirror for release gates --- .github/workflows/build-test-quality-gate.yml | 2 ++ .github/workflows/security-quality-gate.yml | 3 +++ project-docs/V2-rc-freeze-2026-07-20.md | 7 ++++++- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-test-quality-gate.yml b/.github/workflows/build-test-quality-gate.yml index 1d5dbbde..2f0465c8 100644 --- a/.github/workflows/build-test-quality-gate.yml +++ b/.github/workflows/build-test-quality-gate.yml @@ -42,6 +42,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 25 env: + PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple + PIP_DISABLE_PIP_VERSION_CHECK: "1" CONTRACT_API_ENVIRONMENT: test CONTRACT_API_DATABASE_URL: "sqlite+pysqlite:///:memory:" CONTRACT_API_DATABASE_AUTO_CREATE: "true" diff --git a/.github/workflows/security-quality-gate.yml b/.github/workflows/security-quality-gate.yml index 8cf123ed..10d9cc83 100644 --- a/.github/workflows/security-quality-gate.yml +++ b/.github/workflows/security-quality-gate.yml @@ -16,6 +16,9 @@ jobs: name: npm audit, Bandit, pip-audit, detect-secrets runs-on: ubuntu-latest timeout-minutes: 20 + env: + PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple + PIP_DISABLE_PIP_VERSION_CHECK: "1" steps: - name: Checkout diff --git a/project-docs/V2-rc-freeze-2026-07-20.md b/project-docs/V2-rc-freeze-2026-07-20.md index 619ca193..ad870900 100644 --- a/project-docs/V2-rc-freeze-2026-07-20.md +++ b/project-docs/V2-rc-freeze-2026-07-20.md @@ -2,7 +2,7 @@ ## Decision -The current candidate is frozen for release review under tag `v2-rc-20260720`. +The current candidate is frozen for release review under tag `v2-rc-20260720.1`. After the tag is created, only blocking bug fixes, tests, deployment configuration, and release documentation may be added. New product features and schema changes are outside this RC. @@ -25,6 +25,11 @@ deployment/backup/health-check tooling, AI Provider acceptance tooling, authenti review-worker integration, ambient-proxy isolation for internal AI Platform calls, and per-key single-flight protection for Contract API read-cache misses. +Tag `v2-rc-20260720.1` supersedes `v2-rc-20260720`. The original tag remains +immutable; the only follow-up change pins the CI pip index to the same mirror already +validated by the smoke deployment, preventing official-PyPI throughput from blocking +the Python and security jobs before tests begin. + ## Verification evidence | Gate | Result | Evidence |