Review and publish
Production customers use the published version. After development testing, create a Production release, obtain independent review, and explicitly publish it.
Prepare a release
- Prepare separate Production configuration under “Development integration → Sandbox and launch”.
- Check application details, availability, URL, and opening mode. Embedded artifacts need checks for the current draft and real PC testing.
- Under “Application management → Versions and releases”, create a version draft with a version number, change description, and test evidence references.
- Explicitly submit for review. Applicants cannot approve their own release. After rejection, correct the configuration and create a new version.
See application management for version operations and collaborator permissions.
Review security and availability
| Mode | Review focus |
|---|---|
| Redirect | Independent URL, sign-in, application details, and availability scope |
| Isolated iframe | Public artifacts, exact host origins, message validation, sign-in window, and isolation |
| Trusted qiankun mount | Exact artifact code, dependencies and supply chain, shared host page permissions, and explicit approval |
Independent approval for trusted mounts
Artifact checks establish that public resources match registered content. An independent platform reviewer must review code, supply chain, and shared page permission risks and explicitly approve trusted mounting. Passing automated checks cannot replace this decision.
The release, artifacts, application, and environment must match. Changed artifacts or modes require new checks, testing, and a new release.
Publish and verify
Explicitly publish the approved release. Publication rechecks current permissions, resources, and the published version before updating the production entry. Approval alone does not change the customer experience.
Open the application from Console as an intended customer. Confirm the version and opening mode, then verify selected business capabilities. Applications for selected customers do not need public distribution.
New drafts and reviews preserve the existing production version. Recover the original request after an unknown result. Read the current version and publication state after a conflict; sign-in recovery never automatically submits or publishes.
Maintain the application
Use call logs and quality to diagnose problems. Follow application management for suspension and retirement, and application security for key rotation and sensitive actions.