tegwick 5ae1f4ffc5 fix(deploy): pin main-470ece8, and check pins against real builds ... The upgrade failed as `pre-upgrade hooks failed: timed out waiting for the condition`. The migrate hook was in ImagePullBackOff: tag main-11f689d does not exist. `.forgejo/workflows/image.yaml` has a `paths:` filter that excludes deploy/**, so the chart-only commit was green in CI and built nothing — the two green runs on it were host-smoke and container-smoke, not build-and-push. 470ece8 carries all the code; every commit after it touches only the chart and generated docs. scripts/verify_image_pin.py refuses a pin whose commit has no successful build-and-push run, and says so in those terms rather than as a timeout five minutes later. Verified against both the bad pin and the good one; treats an unreachable forge as inconclusive rather than as failure. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006		2026-08-28 00:08:31 +02:00
..
charts/state-hub	feat(forge): point the credential lane at the built OpenBao objects	2026-08-27 23:55:08 +02:00
helm	fix(deploy): pin main-470ece8, and check pins against real builds	2026-08-28 00:08:31 +02:00
manifests	feat(statehub): deploy empty railiance state hub	2026-06-25 15:39:53 +02:00