Add TEST.md: upgrade-testing methodology#23
Merged
Conversation
Documents the extra-care path for high-risk dependency bumps that the PR CVE gate alone can't catch: - major image bumps (mariadb 11->12, redis 7->8, mongo 7->8) - on-disk format changes - major bumps of trusted CI Actions Codifies the isolation rules tests MUST follow so they cannot interact with running production stacks: /tmp-only artefacts, explicit tmp-test- prefixes on project/container/network names, no host-port bindings, no named volumes, no real credentials. Per-test structure (seed -> stop -> upgrade -> verify -> report) with conditional cleanup (only on success) so failed runs leave artefacts in /tmp for inspection. Each upgrade that follows this methodology must add a Verified line to CHANGELOG.md [Unreleased] before the Renovate PR merges.
wnstfy
enabled auto-merge (squash)
May 21, 2026 12:22
Contributor
Trivy misconfiguration findings (HIGH + CRITICAL)✅ No HIGH or CRITICAL misconfigurations detected. |
wnstfy
added a commit
that referenced
this pull request
May 21, 2026
TEST.md describes the maintainer's internal pre-flight upgrade- testing methodology, not project-facing documentation. It was added in #23 but should not have been committed publicly. Local content is preserved off-repo for ongoing use.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New repo doc codifying the pre-flight testing methodology for high-risk dependency bumps that the PR CVE gate alone can't catch.
Scope:
mariadb 11 → 12,redis 7 → 8,mongo 7 → 8).Patch image bumps and application-image bumps stay covered by the existing CVE gate; this is the extra-care path layered on top.
Hard rules (codified)
/tmp/upgrade-tests/<n>/only.tmp-test-prefix on compose project / container / network names, noports:host bindings, no named volumes, bind mounts only into/tmp./tmpfor investigation.### Verifiedblock inCHANGELOG.md[Unreleased]before the Renovate upgrade PR merges.Test plan