catalog-since gate: an image: move must bump the app's catalog_since (R-452) — hook-enforced, shallow CI skips out loud

2026-09-13 19:42:13 +02:00
parent 7410915d82
commit 3f73c0e28a
7 changed files with 200 additions and 8 deletions
@@ -53,6 +53,7 @@ deployed `app.yaml` (customer secrets) is never overwritten. Full deploy details
  version jump). Digest pins (`@sha256:`) also count. Gate: `python scripts/check-image-pins.py`
  (run after any compose change; exit 1 on any floating/missing tag).
 - **Any commit that changes an `image:` line MUST set that app's `catalog_since` to the same day.**
+  **Gated since 2026-09-13 (R-452):** `scripts/check-catalog-since.py` runs in the pre-push hook and refuses an image move whose `catalog_since` is older than the moving commit (CI's shallow clone skips it out loud).
  `.felhom.yml` carries `catalog_since: "YYYY-MM-DD"` — the date THIS repo last moved that app's
  pinned images. It is not a version and not an upstream release date; the controller uses it, and
  only it, to tell a customer *"Frissítés elérhető — 45 napja"*. No version number is ever shown to