test(release): align strict fixtures with RC06 inputs

yuqei-infra/tests/rc06_environment_test_support.py

@@ -0,0 +1,28 @@
+"""Non-secret RC06 values for local release-tool fixtures only."""
+
+
+def rc06_environment_values(*, contract_digest: str, ai_digest: str) -> dict[str, str]:
+    return {
+        "RC06_AI_INTERNAL_SERVER_NAME": "ai-participant.acme.cn",
+        "RC06_AI_PLATFORM_PUBLICATION_SERVICE_KEY": "test-only-rc06-publication-service-secret",  # pragma: allowlist secret
+        "RC06_AI_RELEASE_IMAGE_DIGEST": ai_digest,
+        "RC06_APPLY_SERVICE_PUBLIC_KEY_FILE_HOST": "/test-only/rc06/apply-service-public.pem",
+        "RC06_APPLY_SERVICE_PUBLIC_KEY_SHA256": "a" * 64,
+        "RC06_APPROVAL_KEYRING_EPOCH": "1",
+        "RC06_APPROVAL_ROOT_KEY_ID": "test-only-approval-root-key",
+        "RC06_APPROVAL_ROOT_PUBLIC_KEY_FILE_HOST": "/test-only/rc06/approval-root-public.pem",
+        "RC06_APPROVAL_ROOT_PUBLIC_KEY_SHA256": "b" * 64,
+        "RC06_CONTRACT_RELEASE_IMAGE_DIGEST": contract_digest,
+        "RC06_FACADE_BEARER_TOKEN_FILE": "/test-only/rc06/facade-token",
+        "RC06_FROZEN_CANDIDATE_COMMIT": "c" * 40,
+        "RC06_KMS_CA_FILE_HOST": "/test-only/rc06/kms-ca.pem",
+        "RC06_KMS_CREDENTIAL_FILE": "/test-only/rc06/kms-credential",
+        "RC06_KMS_SIGNING_ENDPOINT": "https://kms.acme.cn",
+        "RC06_LEGAL_REVIEW_KEYRING_SHA256": "d" * 64,
+        "RC06_ONLINE_SIGNING_KEY_REFERENCE": "test-only-signing-key",
+        "RC06_ONLINE_SIGNING_KEY_VERSION": "1",
+        "RC06_ONLINE_SIGNING_PROVIDER": "aliyun",
+        "RC06_ONLINE_SIGNING_PUBLIC_KEY_SPKI_SHA256": "e" * 64,
+        "RC06_PUBLICATION_ENVIRONMENT_ID": "test-only-rc06-environment",
+        "RC06_PUBLICATION_TENANT_ID": "test-only-rc06-tenant",
+    }

yuqei-infra/tests/test_production_release_tools.py

@@ -21,6 +21,8 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
+from rc06_environment_test_support import rc06_environment_values
+
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 
@@ -110,6 +112,12 @@ def production_values() -> dict[str, str]:
         "YUQEI_WORKER_DATABASE_URL": "postgresql+psycopg://yuqei_prod:encoded-password@postgres:5432/yuqei_ai",
     }
     values.update(replacements)
+    values.update(
+        rc06_environment_values(
+            contract_digest="sha256:" + "1" * 64,
+            ai_digest=values["AI_PLATFORM_RELEASE_IMAGE_DIGEST"],
+        )
+    )
     return values
 
 

yuqei-infra/tests/test_release_package_executor.py

@@ -18,6 +18,7 @@ from typing import Any
 import pytest
 
 from owned_infrastructure_test_support import make_object_storage_probe, prepare_owned_case
+from rc06_environment_test_support import rc06_environment_values
 
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
@@ -1200,6 +1201,12 @@ def _write_strict_production_env(
             "YUQEI_WORKER_DATABASE_URL": "postgresql+psycopg://yuqei_prod:encoded-password@postgres:5432/yuqei_ai",
         }
     )
+    values.update(
+        rc06_environment_values(
+            contract_digest=application_images["CONTRACT_API_IMAGE"]["digest"],
+            ai_digest=application_images["AI_PLATFORM_API_IMAGE"]["digest"],
+        )
+    )
     values.update(_public_policy_evidence(evidence))
     path.write_text(
         "".join(f"{key}={value}\n" for key, value in sorted(values.items())),