From 4f13e4ea7cb2bc55e88bd042502a59263b893b06 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Sun, 25 Oct 2026 01:39:02 +0800
Subject: [PATCH] Validate the actual release note before building an image

---
 docs/releases/server-1.6.550.md             |  2 +-
 scripts/test-render-server-release-notes.py | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/docs/releases/server-1.6.550.md b/docs/releases/server-1.6.550.md
index 12c691568c..2f64f57b9d 100644
--- a/docs/releases/server-1.6.550.md
+++ b/docs/releases/server-1.6.550.md
@@ -2,7 +2,7 @@
 
 Prepared source only; no Server image or release has been published.
 
-## Change
+## Verified component inputs
 
 Backport the twelve official PCRE2 `release/pcre2-10.46` commits through
 `947809f11e9c9744aa0974b4b630a1ae461733dd` onto the original Ubuntu 26.04
diff --git a/scripts/test-render-server-release-notes.py b/scripts/test-render-server-release-notes.py
index 16d06c4ef1..a40c7b78cc 100644
--- a/scripts/test-render-server-release-notes.py
+++ b/scripts/test-render-server-release-notes.py
@@ -1,5 +1,6 @@
 import importlib.util
 from pathlib import Path
+import re
 import unittest
 
 spec = importlib.util.spec_from_file_location('notes', Path(__file__).with_name('render-server-release-notes.py'))
@@ -10,6 +11,21 @@
 class PublicationNotes(unittest.TestCase):
     source = '# Server v1.6.546 candidate\n\nNot published.\n\n## Verified component inputs\n\n- Exact input.\n'
 
+    def test_actual_current_release_note_has_the_required_evidence_boundary(self):
+        root = Path(__file__).resolve().parents[1]
+        recipe = (root / 'server/Dockerfile.web-compose-release').read_text(encoding='utf-8')
+        tags = set(re.findall(r'^ARG SERVER_RELEASE_TAG=(v[0-9]+\.[0-9]+\.[0-9]+)$', recipe, re.M))
+        self.assertEqual(1, len(tags))
+        tag = tags.pop()
+        body = (root / ('docs/releases/server-' + tag[1:] + '.md')).read_text(encoding='utf-8')
+        self.assertEqual(1, body.count('## Verified component inputs\n'))
+        if body.startswith('# Server ' + tag + ' candidate\n'):
+            # In-memory format validation only; these fixture identities are
+            # never written to release assets or presented as a real image.
+            notes.render(body, tag, 'sha256:' + 'a' * 64, 'b' * 40)
+        else:
+            self.assertTrue(body.startswith('# Server ' + tag + '\n'))
+
     def test_publication_identity_is_exact_and_deployment_is_not_claimed(self):
         result = notes.render(self.source, 'v1.6.546', 'sha256:' + 'a' * 64, 'b' * 40)
         self.assertIn('server:v1.6.546@sha256:' + 'a' * 64, result)