From 3119ee33d626c46c6625a2ea956779c6a7904a44 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 13 Aug 2026 00:59:51 +0200 Subject: [PATCH] Pin audit-core image digest 41493cd5 for railiance01 Published from commit 3a7d63e to forgejo.coulomb.social/coulomb/audit-core. Deployment still waits on T02 ESO secrets. --- WORK-RECORDS.md | 4 ++-- deploy/README.md | 2 +- deploy/audit-core.yaml | 2 +- deploy/migrate-job.yaml | 2 +- ...-0005-postgres-store-and-production-deployment.md | 12 ++++++------ 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e5aebd3..1d2de2d 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -29,8 +29,8 @@ | task | AUDIT-WP-0004-T06 | done | — | workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md | | task | AUDIT-WP-0004-T07 | done | — | workplans/AUDIT-WP-0004-receiver-correctness-and-hardening.md | | task | AUDIT-WP-0005-T01 | done | — | workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md | -| task | AUDIT-WP-0005-T02 | todo | — | workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md | +| task | AUDIT-WP-0005-T02 | progress | — | workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md | | task | AUDIT-WP-0005-T03 | progress | — | workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md | | task | AUDIT-WP-0005-T04 | done | — | workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md | | task | AUDIT-WP-0005-T05 | progress | — | workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md | -| task | AUDIT-WP-0005-T06 | todo | — | workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md | +| task | AUDIT-WP-0005-T06 | progress | — | workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md | diff --git a/deploy/README.md b/deploy/README.md index a859689..469c115 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -8,7 +8,7 @@ the server port or export a copy before applying. Apply order is documented in `docs/operator-runbook.md`. Do not apply the Deployment until: -1. The image digest is pinned (not `REPLACE_AT_RELEASE`). +1. The image digest is pinned (currently `sha256:41493cd5…` from commit `3a7d63e`). 2. Secrets `audit-core-database`, `audit-core-database-migrate`, and `audit-core-senders` exist. 3. Job `audit-core-migrate` has completed. diff --git a/deploy/audit-core.yaml b/deploy/audit-core.yaml index 8d6be24..ff0d939 100644 --- a/deploy/audit-core.yaml +++ b/deploy/audit-core.yaml @@ -78,7 +78,7 @@ spec: - name: audit-core # REPLACE at release time with the built digest. A mutable tag is not # an immutable image, and `:latest` must never be the only reference. - image: forgejo.coulomb.social/coulomb/audit-core@sha256:REPLACE_AT_RELEASE + image: forgejo.coulomb.social/coulomb/audit-core@sha256:41493cd5bbd86a3309af07b1a97d41343b91d758a300ad39d71e4a18c17de7cc imagePullPolicy: IfNotPresent ports: - name: http diff --git a/deploy/migrate-job.yaml b/deploy/migrate-job.yaml index c9392d0..c6a0919 100644 --- a/deploy/migrate-job.yaml +++ b/deploy/migrate-job.yaml @@ -31,7 +31,7 @@ spec: type: RuntimeDefault containers: - name: migrate - image: forgejo.coulomb.social/coulomb/audit-core@sha256:REPLACE_AT_RELEASE + image: forgejo.coulomb.social/coulomb/audit-core@sha256:41493cd5bbd86a3309af07b1a97d41343b91d758a300ad39d71e4a18c17de7cc imagePullPolicy: IfNotPresent command: ["python", "-m", "audit_core", "migrate"] env: diff --git a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md index a8cbe3c..8a3bb37 100644 --- a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md +++ b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md @@ -299,13 +299,13 @@ carries `sha256:REPLACE_AT_RELEASE` until the ESO secrets exist, and applying it now would ImagePullBackOff and then CrashLoop on a missing sender registry. -An image was published to `forgejo.coulomb.social/coulomb/audit-core` during -this session; rebuild and pin after the commit that contains these files so -the label matches the content. +Image for commit `3a7d63e` is published and pinned: -Remaining before done: pin the post-commit digest in -`deploy/audit-core.yaml` and `deploy/migrate-job.yaml`, apply migrate Job -then Deployment once T02 secrets exist, and verify restart, reschedule, and +`forgejo.coulomb.social/coulomb/audit-core@sha256:41493cd5bbd86a3309af07b1a97d41343b91d758a300ad39d71e4a18c17de7cc` + +The Deployment is still not applied: it would start and then fail on a +missing sender registry and database lease. Apply migrate Job then +Deployment once T02 secrets exist, and verify restart, reschedule, and `kubectl rollout undo`. ## T04 - Migrate existing SQLite records