coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

AUDIT-WP-0013-T07: pin receiver image sha256:304cfb83 built from 8185893

Browse source 
Carries the T06 independent full-scope reconciliation reader and the
AUDIT-WP-0018-T02 reject-only secret_policy overlay. No migration beyond
0007; the migration Job needs no rerun. Full suite incl. PostgreSQL
backend: 373 passed (1 unrelated live-catalog env failure).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
This commit is contained in:
tegwick 2026-11-03 21:50:54 +01:00
parent 818589359a
commit b36552545d
3 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
deploy/README.md
View file

@ -8,7 +8,7 @@ the server port or export a copy before applying.
Apply order is documented in `docs/operator-runbook.md`. Do not apply the
Deployment until:
1. The image digest is pinned (currently `sha256:b479801b…` built from source commit `5227fb14e47f26a01930be4611360fd90f740662`).
1. The image digest is pinned (currently `sha256:304cfb83…` built from source commit `818589359ae343d821a009413823f4456962c0d1`, AUDIT-WP-0013-T07).
2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
`audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
@ -34,3 +34,10 @@ an undocumented repair. Both receiver and migration Job pin immutable image
built from source `5227fb14e47f26a01930be4611360fd90f740662`; this follow-up
changes deployment configuration only and requires no image rebuild. Migration
0007 adds import receipts and indexes without changing existing event rows.
AUDIT-WP-0013-T07 (2026-11-03) re-pins receiver and migration Job to
`forgejo.coulomb.social/coulomb/audit-core@sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300`,
built from `818589359ae343d821a009413823f4456962c0d1`. It carries the T06
independent full-scope reconciliation reader and the AUDIT-WP-0018-T02
reject-only secret_policy overlay. No migration beyond 0007 is added, so no
migration Job run is required; rollback to `b479801b…` stays schema-compatible.

2
deploy/audit-core.yaml
View file

@ -86,7 +86,7 @@ spec:
- name: audit-core
# REPLACE at release time with the built digest. A mutable tag is not
# an immutable image, and `:latest` must never be the only reference.
image: forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271
image: forgejo.coulomb.social/coulomb/audit-core@sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300
imagePullPolicy: IfNotPresent
ports:
- name: http

2
deploy/migrate-job.yaml
View file

@ -34,7 +34,7 @@ spec:
type: RuntimeDefault
containers:
- name: migrate
image: forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271
image: forgejo.coulomb.social/coulomb/audit-core@sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300
imagePullPolicy: IfNotPresent
command: ["python", "-m", "audit_core", "migrate"]
env: