From 5688dd13c5cf5cfc19bfb73a3482451db2e4c89c Mon Sep 17 00:00:00 2001
From: yuqei <cyuqei@gmail.com>
Date: Mon, 21 Sep 2026 20:24:35 +0800
Subject: [PATCH] fix: cover trusted CA in release compose gate

---
 yuqei-infra/scripts/linux_release_common.py         |  1 +
 yuqei-infra/tests/test_linux_release_build_tools.py | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/yuqei-infra/scripts/linux_release_common.py b/yuqei-infra/scripts/linux_release_common.py
index 51ac7488..08bc4f27 100644
--- a/yuqei-infra/scripts/linux_release_common.py
+++ b/yuqei-infra/scripts/linux_release_common.py
@@ -700,6 +700,7 @@ def synthetic_compose_gate_env_bytes() -> bytes:
             "AI_PROVIDER_API_KEY_FILE": "/synthetic/not-a-secret/provider-api-key",
             "BACKEND_SERVER_NAME": "synthetic.invalid",
             "BACKEND_TLS_CERT_DIR": "/synthetic/tls",
+            "BACKEND_TLS_TRUSTED_CA_FILE": "/synthetic/tls/trusted-ca.pem",
             "BACKUP_HOST_DIR": "/synthetic/backups",
             "COMPOSE_PROJECT_NAME": "yuqei-rc04-structural-gate",
             "CONTRACT_API_PUBLIC_POLICY_RELEASE_DIGEST": "sha256:" + "e" * 64,
diff --git a/yuqei-infra/tests/test_linux_release_build_tools.py b/yuqei-infra/tests/test_linux_release_build_tools.py
index 21b92ede..46f4d2c7 100644
--- a/yuqei-infra/tests/test_linux_release_build_tools.py
+++ b/yuqei-infra/tests/test_linux_release_build_tools.py
@@ -5,6 +5,7 @@ import gzip
 import importlib.util
 import json
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -571,6 +572,17 @@ def _synthetic_compose_env_values() -> dict[str, str]:
     return values
 
 
+def test_synthetic_compose_gate_env_covers_required_interpolation() -> None:
+    required: set[str] = set()
+    for relative_path in common.COMPOSE_GATE_POLICY["compose_inputs"]:
+        compose_text = (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+        required.update(re.findall(r"\$\{([A-Z][A-Z0-9_]*):\?", compose_text))
+
+    values = _synthetic_compose_env_values()
+    assert required <= values.keys()
+    assert values["BACKEND_TLS_TRUSTED_CA_FILE"] == "/synthetic/tls/trusted-ca.pem"
+
+
 def _compose_model(
     *, mode: str, profile_name: str, profiles: tuple[str, ...]
 ) -> dict[str, Any]: