From 1d5516d2afb79c4c714dd2d7302b61dc7983d8b4 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Tue, 10 Nov 2026 15:09:18 +0800
Subject: [PATCH] ci: add shared digest candidate release workflow

Co-Authored-By: Codex <noreply@openai.com>
---
 .../workflows/release-digest-candidate.yml    | 40 +++++++++++++++++++
 docs/unified-daily-notification.md            |  8 ++++
 2 files changed, 48 insertions(+)
 create mode 100644 .github/workflows/release-digest-candidate.yml

diff --git a/.github/workflows/release-digest-candidate.yml b/.github/workflows/release-digest-candidate.yml
new file mode 100644
index 0000000..a5b6179
--- /dev/null
+++ b/.github/workflows/release-digest-candidate.yml
@@ -0,0 +1,40 @@
+name: Digest candidate job release
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: Protected release environment
+        type: choice
+        required: true
+        options:
+          - digest-candidate-release
+          - digest-candidate-release-test
+      operation:
+        description: Release operation
+        type: choice
+        required: true
+        default: verify
+        options:
+          - verify
+          - deploy
+          - rollback
+permissions: {}
+jobs:
+  release:
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      (inputs.target == 'digest-candidate-release-test' ||
+       (inputs.target == 'digest-candidate-release' && inputs.operation == 'verify'))
+    permissions:
+      id-token: write
+    uses: QuantStrategyLab/.github/.github/workflows/deploy-job.yml@fcf38f37e25c34580776ef1318718f434286f6e2
+    with:
+      provider: gcp
+      environment: ${{ inputs.target }}
+      operation: ${{ inputs.operation }}
+    secrets:
+      DEPLOY_WIF_PROVIDER: ${{ secrets.DEPLOY_WIF_PROVIDER }}
+      DEPLOY_SERVICE_ACCOUNT: ${{ secrets.DEPLOY_SERVICE_ACCOUNT }}
+      DEPLOY_RESOURCE: ${{ secrets.DEPLOY_RESOURCE }}
+      DEPLOY_PREVIOUS_IMAGE: ${{ secrets.DEPLOY_PREVIOUS_IMAGE }}
+      DEPLOY_CANDIDATE_IMAGE: ${{ secrets.DEPLOY_CANDIDATE_IMAGE }}
diff --git a/docs/unified-daily-notification.md b/docs/unified-daily-notification.md
index bbd9c65..021c50d 100644
--- a/docs/unified-daily-notification.md
+++ b/docs/unified-daily-notification.md
@@ -99,6 +99,14 @@ notification routes or cloud permissions. It does not establish delivery success
 
 ## Publication before the central daily read
 
+Run the manual `Digest candidate job release` workflow from the default
+branch. The production environment supports `verify`, which reads back the
+pinned Cloud Run Job image through a dedicated short-lived Google identity.
+Deploy and rollback are available for the isolated test environment. The
+workflow does not invoke the producer or change its schedule.
+
+[Organization container release contract](https://github.com/QuantStrategyLab/.github/blob/main/docs/deployment-workflows.md)
+
 GitHub schedule events can start late. A heartbeat workflow is therefore not a
 reliable deadline trigger for the 07:00 Asia/Shanghai read. Keep its existing
 monitoring checks, but run the archive-only publisher independently in an