Repository navigation
ci(cd): the build fact names the whole promoted set — tester, portal and migration digests from this run's version tag - #2718
Merged
Conversation
…and migration digests, resolved from this run's version tag Plugins' PlatformPinUpdater moves only the tester pin; with Plugins #940 the portal pin (MW_PORTAL_IMAGE_DIGEST + the platform-image-digest literals) must move with it, which needs the fact to carry the promoted portal digest. All three are resolved from <image>:<version> — the tag the promote job writes for this set — never :main, which moves the moment another run promotes and could name a set this run did not build. Extra fields are ignored by the inbox watcher's ParseBuild (TryGetProperty on the known ones), so the change is backward compatible. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the main CD workflow’s “build fact” payload so downstream consumers can pin a coherent promoted image set (tester, portal, migration) using digests resolved from the current run’s version tag rather than the moving :main tag.
Changes:
- Resolve
mw-plugin-test,memex-portal-ai, andmemex-migrationdigests from:<version>and include them in the signed webhook body. - Fail the job if any of the required digests cannot be resolved, preventing delivery of a fact that references non-existent pins.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
… empty under set -e, and the guard checks the sha256: shape Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Plugins'
PlatformPinUpdatermoves onlyMW_IMAGE_DIGEST. With Plugins #940 (module lane compiles against the portal image) the portal pin (MW_PORTAL_IMAGE_DIGEST+ theplatform-image-digestliterals) must move with it — Plugins #944 — which needs the CD build fact to carry the promoted portal digest. This is the core half.What
Sign and POST the build factnow resolves three digests from this run's version tag (<image>:<version>, the tag the promote job writes for the set) — never:main, which moves the moment another run promotes:image/digest—mw-plugin-test(as before, but race-free)portalImage/portalDigest—memex-portal-aimigrationImage/migrationDigest—memex-migrationEach unresolved digest is RED (
::error+exit 1, the guard's pairing holds: 6/6). Backward compatible: the inbox watcher'sParseBuildreads known fields withTryGetPropertyand ignores the rest.Verified
PlatformReleaseNotifyGuard+UpstreamBuildGateGuard+ shell guards 10/10 (Release-warnaserror, 0 errors);check-workflow-shell.py0 live; body shape checked withjq.🤖 Generated with Claude Code