vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-08-22 23:43:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Harden demo SSH setup for IP targets

Browse source
This commit is contained in:
rcourtman 2026-07-09 17:06:52 +01:00
parent 76ced45c3a
commit 2be167331d
6 changed files with 144 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/release-control/v6/internal/subsystems/deployment-installability.md
View file

@ -1183,10 +1183,11 @@ Those same governed demo deploy/update workflows also own the runner-to-host
network path. They must establish the canonical Tailscale connectivity step
before SSH setup so stable or preview targets may stay on governed private
hostnames or Tailscale IPs, rather than silently depending on public SSH
reachability from GitHub-hosted runners. After Tailscale setup, SSH setup must
wait for the configured demo host to resolve and return host keys with bounded
reachability from GitHub-hosted runners. After Tailscale setup, shared SSH
setup must wait for configured demo hostnames to resolve, accept configured IP
literals without a DNS precheck, and then capture host keys with bounded
retries before any installer or binary copy runs; a one-shot `ssh-keyscan`
against a private demo hostname is not sufficient release or deploy proof.
against a private demo target is not sufficient release or deploy proof.
Those same workflows also own customer-visible browser truth for the public
demo shell. Health checks and entry-asset parity are necessary but not
sufficient; after those checks pass, the governed helpers