fix(release): make deployment backup and rollback immutable

backend/tests/test_rc6_supply_chain.py

@@ -48,13 +48,54 @@ def test_ci_runs_complete_release_and_supply_chain_gates() -> None:
         assert "pip-audit==2.10.1" in workflow
         assert "audit_python_dependencies.sh" in workflow
         assert "npm audit --audit-level=high" in workflow
-        assert "GEOINTEL_INSTALL_AI=false" in workflow
+        assert "GEOINTEL_INSTALL_AI=true" in workflow
+        assert "geointel-ci:$RELEASE_SHA-ai" in workflow
+        assert "artifacts/image-id.txt" in workflow
+        assert 'scan_container_image.sh "$IMAGE_ID"' in workflow
         assert "generate_container_sbom.sh" in workflow
         assert "scan_container_image.sh" in workflow
-        assert "actions/upload-artifact@v4" in workflow
+        assert "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" in workflow
         assert context in workflow
 
 
+def test_gitea_production_deploy_depends_on_every_release_gate() -> None:
+    release = read(".gitea/workflows/release-gates.yml")
+    legacy_deploy = ROOT / ".gitea" / "workflows" / "unraid-deploy.yml"
+
+    assert "pull_request:" in release
+    assert "needs: [quality, dependency-audit, container]" in release
+    assert "gitea.event_name == 'push'" in release
+    assert "gitea.ref == 'refs/heads/main'" in release
+    assert "/opt/gitea-deploy/deploy.py deploy" in release
+    assert not legacy_deploy.exists()
+    assert "workflow_dispatch:" in release
+
+
+def test_release_workflows_pin_third_party_actions_to_reviewed_commits() -> None:
+    expected = (
+        "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683",
+        "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065",
+        "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020",
+        "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02",
+    )
+    for path in (".gitea/workflows/release-gates.yml", ".github/workflows/release-gates.yml"):
+        workflow = read(path)
+        for action in expected:
+            assert action in workflow
+
+
+def test_managed_validation_targets_the_actual_backend_and_frontend_projects() -> None:
+    workflow = read(".gitea/workflows/managed-validation.yml")
+
+    assert "backend/requirements-ci.lock" in workflow
+    assert "frontend/package-lock.json" in workflow
+    assert "python -m pytest -W error::DeprecationWarning" in workflow
+    assert "cd frontend && npm run test:unit" in workflow
+    assert "python -m ruff check backend scripts tests" in workflow
+    assert "python scripts/verify_repository_layout.py" in workflow
+    assert "[[ -f pyproject.toml" not in workflow
+
+
 def test_scanner_images_are_versioned_and_digest_pinned() -> None:
     sbom = read("scripts/generate_container_sbom.sh")
     scan = read("scripts/scan_container_image.sh")
@@ -65,8 +106,9 @@ def test_scanner_images_are_versioned_and_digest_pinned() -> None:
     assert "--ignore-unfixed" in scan
     assert "--timeout 20m" in scan
     assert "--scanners vuln" in scan
-    assert '-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro"' in scan
-    assert '--ignorefile "$CONTAINER_IGNORE_FILE"' in scan
+    assert 'ignored_container_ids' in scan
+    assert 'ignore_args=(-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro")' in scan
+    assert 'trivy_ignore_args=(--ignorefile "$CONTAINER_IGNORE_FILE")' in scan
     assert "--skip-files /usr/local/bin/gosu" in scan
     assert "final filesystem replaces it with the audited setpriv shell wrapper" in scan
     assert "geointel-container-vulnerabilities.json" in scan
@@ -86,11 +128,12 @@ def test_readiness_guards_lock_and_supply_chain_entrypoints() -> None:
         assert f"bash -n {path}" in readiness
 
 
-def test_python_audit_exceptions_are_timeboxed_and_full_evidence_is_kept() -> None:
+def test_python_audit_policy_has_no_active_exceptions_and_keeps_full_evidence() -> None:
     policy = read("security/pip-audit-exceptions.json")
     audit_script = read("scripts/audit_python_dependencies.sh")
 
-    assert '"review_by": "2026-08-31"' in policy
+    assert '"schema_version": 1' in policy
+    assert '"advisories": []' in policy
     assert "pip-audit-full.json" in audit_script
     assert "pip-audit-policy.json" in audit_script
     assert "--ignore-vuln" in audit_script