coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin published approval-engine release candidate

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 23:32:19 +02:00
parent d7a9fe53db
commit b51d174500
3 changed files with 32 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
deploy/approval-engine.yaml
View file

@ -42,7 +42,7 @@ spec:
seccompProfile: {type: RuntimeDefault} seccompProfile: {type: RuntimeDefault}
initContainers: initContainers:
- name: migrate - name: migrate
image: forgejo.coulomb.social/coulomb/approval-engine@sha256:REPLACE_WITH_RELEASE_DIGEST image: forgejo.coulomb.social/coulomb/approval-engine@sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d
args: ["migrate", "--db", "/data/approvals.sqlite"] args: ["migrate", "--db", "/data/approvals.sqlite"]
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
@ -53,7 +53,7 @@ spec:
- {name: tmp, mountPath: /tmp} - {name: tmp, mountPath: /tmp}
containers: containers:
- name: approval-engine - name: approval-engine
image: forgejo.coulomb.social/coulomb/approval-engine@sha256:REPLACE_WITH_RELEASE_DIGEST image: forgejo.coulomb.social/coulomb/approval-engine@sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d
args: args:
- serve - serve
- --production - --production

15
docs/image-scan-2026-09-06.md
View file

@ -172,3 +172,18 @@ docker inspect --format '{{index .RepoDigests 0}}' \
Then pin both `image:` references in `deploy/approval-engine.yaml` to that Then pin both `image:` references in `deploy/approval-engine.yaml` to that
digest. Rollout, restart and restore evidence remain gated on the KeyCape digest. Rollout, restart and restore evidence remain gated on the KeyCape
registrations and the audit sender credential, which are still unmaterialized. registrations and the audit sender credential, which are still unmaterialized.
## Registry publication — 2026-09-06, Glas deployment session
The previously blocked push succeeded under the operator's standing production
deployment authorization. Registry tag `0.1.0` resolves to OCI index digest
`sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d`.
The linux/amd64 image manifest is
`sha256:2064d5378e01801ecf9966ccec9c93aadd16d6b404ef4890983d89fa738c164c`.
Both deployment images now pin the registry index digest, verified remotely
following publication. Its equality to the earlier local image identifier is
not the evidence of publication; the successful push and remote index lookup are.
No StatefulSet rollout yet: live KeyCape registrations and audit sender/token
admission remain outstanding. APPROVAL-WP-0002-T03 stays wait for those gates.

15
workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
View file

@ -419,3 +419,18 @@ claim/store comparison requires an owner-consistent choice before activation.
Do not substitute guessed values or start production without audit delivery. Do not substitute guessed values or start production without audit delivery.
The secrets-engine PDP was independently deployed by FLEX-WP-0021-T04; this The secrets-engine PDP was independently deployed by FLEX-WP-0021-T04; this
does not satisfy approval service readiness. does not satisfy approval service readiness.
## Registry publication — 2026-09-06, Glas deployment session
The previously blocked push succeeded under the operator's standing production
deployment authorization. Registry tag `0.1.0` resolves to OCI index digest
`sha256:73333f5ceb55e48192e3095cb2e2a741cdc6ff0be2f18128301072b4a6b6eb9d`.
The linux/amd64 image manifest is
`sha256:2064d5378e01801ecf9966ccec9c93aadd16d6b404ef4890983d89fa738c164c`.
Both deployment images now pin the registry index digest, verified remotely
following publication. Its equality to the earlier local image identifier is
not the evidence of publication; the successful push and remote index lookup are.
No StatefulSet rollout yet: live KeyCape registrations and audit sender/token
admission remain outstanding. APPROVAL-WP-0002-T03 stays wait for those gates.