From bf6beb30f67459f9f0c9f3e22e3a454dd7a9deef Mon Sep 17 00:00:00 2001
From: yuqei <cyuqei@gmail.com>
Date: Wed, 7 Oct 2026 20:46:48 +0800
Subject: [PATCH] test(release): align strict fixtures with RC06 inputs

---
 .../tests/rc06_environment_test_support.py    | 28 +++++++++++++++++++
 .../tests/test_production_release_tools.py    |  8 ++++++
 .../tests/test_release_package_executor.py    |  7 +++++
 3 files changed, 43 insertions(+)
 create mode 100644 yuqei-infra/tests/rc06_environment_test_support.py

diff --git a/yuqei-infra/tests/rc06_environment_test_support.py b/yuqei-infra/tests/rc06_environment_test_support.py
new file mode 100644
index 00000000..529c2cce
--- /dev/null
+++ b/yuqei-infra/tests/rc06_environment_test_support.py
@@ -0,0 +1,28 @@
+"""Non-secret RC06 values for local release-tool fixtures only."""
+
+
+def rc06_environment_values(*, contract_digest: str, ai_digest: str) -> dict[str, str]:
+    return {
+        "RC06_AI_INTERNAL_SERVER_NAME": "ai-participant.acme.cn",
+        "RC06_AI_PLATFORM_PUBLICATION_SERVICE_KEY": "test-only-rc06-publication-service-secret",  # pragma: allowlist secret
+        "RC06_AI_RELEASE_IMAGE_DIGEST": ai_digest,
+        "RC06_APPLY_SERVICE_PUBLIC_KEY_FILE_HOST": "/test-only/rc06/apply-service-public.pem",
+        "RC06_APPLY_SERVICE_PUBLIC_KEY_SHA256": "a" * 64,
+        "RC06_APPROVAL_KEYRING_EPOCH": "1",
+        "RC06_APPROVAL_ROOT_KEY_ID": "test-only-approval-root-key",
+        "RC06_APPROVAL_ROOT_PUBLIC_KEY_FILE_HOST": "/test-only/rc06/approval-root-public.pem",
+        "RC06_APPROVAL_ROOT_PUBLIC_KEY_SHA256": "b" * 64,
+        "RC06_CONTRACT_RELEASE_IMAGE_DIGEST": contract_digest,
+        "RC06_FACADE_BEARER_TOKEN_FILE": "/test-only/rc06/facade-token",
+        "RC06_FROZEN_CANDIDATE_COMMIT": "c" * 40,
+        "RC06_KMS_CA_FILE_HOST": "/test-only/rc06/kms-ca.pem",
+        "RC06_KMS_CREDENTIAL_FILE": "/test-only/rc06/kms-credential",
+        "RC06_KMS_SIGNING_ENDPOINT": "https://kms.acme.cn",
+        "RC06_LEGAL_REVIEW_KEYRING_SHA256": "d" * 64,
+        "RC06_ONLINE_SIGNING_KEY_REFERENCE": "test-only-signing-key",
+        "RC06_ONLINE_SIGNING_KEY_VERSION": "1",
+        "RC06_ONLINE_SIGNING_PROVIDER": "aliyun",
+        "RC06_ONLINE_SIGNING_PUBLIC_KEY_SPKI_SHA256": "e" * 64,
+        "RC06_PUBLICATION_ENVIRONMENT_ID": "test-only-rc06-environment",
+        "RC06_PUBLICATION_TENANT_ID": "test-only-rc06-tenant",
+    }
diff --git a/yuqei-infra/tests/test_production_release_tools.py b/yuqei-infra/tests/test_production_release_tools.py
index 522099a9..bc0678f6 100644
--- a/yuqei-infra/tests/test_production_release_tools.py
+++ b/yuqei-infra/tests/test_production_release_tools.py
@@ -21,6 +21,8 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
+from rc06_environment_test_support import rc06_environment_values
+
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 
@@ -110,6 +112,12 @@ def production_values() -> dict[str, str]:
         "YUQEI_WORKER_DATABASE_URL": "postgresql+psycopg://yuqei_prod:encoded-password@postgres:5432/yuqei_ai",
     }
     values.update(replacements)
+    values.update(
+        rc06_environment_values(
+            contract_digest="sha256:" + "1" * 64,
+            ai_digest=values["AI_PLATFORM_RELEASE_IMAGE_DIGEST"],
+        )
+    )
     return values
 
 
diff --git a/yuqei-infra/tests/test_release_package_executor.py b/yuqei-infra/tests/test_release_package_executor.py
index 92ff01ec..ae33c66b 100644
--- a/yuqei-infra/tests/test_release_package_executor.py
+++ b/yuqei-infra/tests/test_release_package_executor.py
@@ -18,6 +18,7 @@ from typing import Any
 import pytest
 
 from owned_infrastructure_test_support import make_object_storage_probe, prepare_owned_case
+from rc06_environment_test_support import rc06_environment_values
 
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
@@ -1200,6 +1201,12 @@ def _write_strict_production_env(
             "YUQEI_WORKER_DATABASE_URL": "postgresql+psycopg://yuqei_prod:encoded-password@postgres:5432/yuqei_ai",
         }
     )
+    values.update(
+        rc06_environment_values(
+            contract_digest=application_images["CONTRACT_API_IMAGE"]["digest"],
+            ai_digest=application_images["AI_PLATFORM_API_IMAGE"]["digest"],
+        )
+    )
     values.update(_public_policy_evidence(evidence))
     path.write_text(
         "".join(f"{key}={value}\n" for key, value in sorted(values.items())),