Repository navigation
Fix Orion promotion for digest-first manifests - #9
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Orion image publication and boot smoke succeeded, but GitOps promotion rejects the actual manifest layout, which places the image digest first as
- digest:. The deployment helper only recognizes an indenteddigest:field.Accept the optional YAML list prefix when counting and replacing the single image digest. Keep the exact-one-digest guard and immutable image/repository restrictions. Add a native shell regression that exercises actual local Git repositories and pushes for both key orders, checks repeat promotion is idempotent, and confirms ambiguous digest entries cannot be published.
Validation: the new native regression passed the name-first layout but failed the digest-first layout before the fix. Both layouts, repeat promotion, ambiguous-digest rejection, shell syntax and ShellCheck pass after it. This deployment-only change has no provider wire effect and needs no provider-harness case.
The application image is already built and boot-smoked at
ghcr.io/euforicio/bifrost@sha256:2974c023480a358d1e19dfe1a553700dcf19aeadc58eab504a309addc3161235from runtime source commitf4321178eba9010e85b76667485e53bd306edd42. This helper repair changes no application or Docker build sources; the verified artifact can be promoted through the existing selected-digest workflow.Deployment completed: the selected-digest workflow succeeded, Flux applied Orion commit
a905429573b1aa19014e49367d955bc10808b8d8, the pod is ready, and the public version reports the tested runtime commit. Authenticated management checks pass; all record identifiers, counts, runtime secrets, and encrypted account credentials match the pre-deployment baseline.