From 3ddef4cedc19213c82eaa27522bce76cb90259ba Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 3 Nov 2026 22:07:26 +0100 Subject: [PATCH] Pin the released audit-core receiver (304cfb83, AUDIT-WP-0013-T07) in the recovery preflight. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 236506@bnt-lap001 Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4 --- scripts/audit-core-recovery-preflight.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/scripts/audit-core-recovery-preflight.py b/scripts/audit-core-recovery-preflight.py index 641893c..50f49e0 100755 --- a/scripts/audit-core-recovery-preflight.py +++ b/scripts/audit-core-recovery-preflight.py @@ -20,11 +20,12 @@ from pathlib import Path from typing import Any -# audit-core release pinned by audit-core 1269a0e (2026-10-15, deploy/audit-core.yaml); -# the previously reviewed ec15f63d image now remains only on the attest-chain CronJob. +# audit-core release pinned by audit-core b365525 (2026-11-03, AUDIT-WP-0013-T07, +# deploy/audit-core.yaml), built from 8185893. The attest-chain CronJob may run +# an older image and is not checked here. EXPECTED_IMAGE = ( "forgejo.coulomb.social/coulomb/audit-core@" - "sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271" + "sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300" ) EXPECTED_DB_KEYS = {"username", "password", "host", "port", "dbname"}