feat(release): require versioned locked publication

tests/release/test_image_contracts.py

@@ -17,10 +17,27 @@ def _step_index(steps, name):
     return next(index for index, step in enumerate(steps) if step.get("name") == name)
 
 
-def test_workflow_triggers_only_main_and_v_tags():
+def test_workflow_triggers_only_v_tag_push_candidates():
     workflow = _workflow()
     assert set(workflow["on"]) == {"push"}
-    assert workflow["on"]["push"] == {"branches": ["main"], "tags": ["v*"]}
+    assert workflow["on"]["push"] == {"tags": ["v*"]}
+
+
+def test_workflow_rejects_non_strict_version_events_before_checkout_and_build():
+    steps = _workflow()["jobs"]["verify"]["steps"]
+    guard = steps[0]
+    assert guard["name"] == "Reject non-version publication events"
+    assert guard["env"] == {
+        "PUBLICATION_EVENT": "${{ github.event_name }}",
+        "PUBLICATION_REF": "${{ github.ref }}",
+    }
+    assert '"${PUBLICATION_EVENT}" != "push"' in guard["run"]
+    strict_ref = (
+        r"^refs/tags/v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$"
+    )
+    assert strict_ref in guard["run"]
+    assert _step_index(steps, guard["name"]) < _step_index(steps, "Check out exact source commit")
+    assert _step_index(steps, guard["name"]) < _step_index(steps, "Build source image once")
 
 
 def test_publish_is_gated_and_has_the_only_package_write_permission():
@@ -123,6 +140,7 @@ def test_publish_job_has_only_download_then_verified_publish_helper():
   --image-id tested-image/trex-core-image.id \\
   --local-image "trex-core-ci:${GITHUB_SHA}" \\
   --commit "${GITHUB_SHA}" \\
+  --event-name "${GITHUB_EVENT_NAME}" \\
   --ref "${GITHUB_REF}"'''
     assert steps[1]["run"].strip() == expected_run
 
@@ -148,7 +166,10 @@ def test_workflow_uses_full_sha_and_contains_no_latest_tag():
 def test_docker_context_contract():
     dockerfile = (REPO / "Dockerfile").read_text()
     copy_lines = [line.strip() for line in dockerfile.splitlines() if line.strip().startswith("COPY ")]
-    assert copy_lines == ["COPY pyproject.toml ./", "COPY trex_core/ ./trex_core/"]
+    assert copy_lines == ["COPY pyproject.toml uv.lock ./", "COPY trex_core/ ./trex_core/"]
+    assert 'python -m pip install --no-cache-dir "uv==0.11.14"' in dockerfile
+    assert "uv sync --locked --no-dev --no-editable" in dockerfile
+    assert "pip install --no-cache-dir ." not in dockerfile
     assert "org.opencontainers.image.revision" in dockerfile
     assert "python:3.12" in dockerfile
 
@@ -158,6 +179,9 @@ def test_docker_context_contract():
 
 def test_operator_documentation_preserves_rollback_boundaries():
     operations = (REPO / "docs" / "operations.md").read_text()
+    assert "strict `vX.Y.Z` Git tag" in operations
+    assert "사용자 승인 외부 쓰기" in operations
+    assert "Git tag version은 `pyproject.toml` package version과 독립" in operations
     assert "read-only volume" in operations
     assert "runtime environment" in operations
     assert "sha256:<64-hex>" in operations