From fffd2fbfc8ed927eba00f25475a7195686301b6c Mon Sep 17 00:00:00 2001 From: Guilherme Santos Date: Tue, 28 Jul 2026 16:14:45 +0200 Subject: [PATCH] fix(lcm): point stable latest at the promoted version digest stable/:latest was copied independently from staging/:latest, This PR tags latest from the stable version tag that was just promoted instead, so the two are the same manifest by construction, and assert the digests match before the step succeeds. Also add set -euo pipefail so a crane failure mid-loop fails the step rather than being masked by the loop's last command. --- .github/workflows/promote-to-stable.yaml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/promote-to-stable.yaml b/.github/workflows/promote-to-stable.yaml index b8e1aef72..36e02c4ca 100644 --- a/.github/workflows/promote-to-stable.yaml +++ b/.github/workflows/promote-to-stable.yaml @@ -48,17 +48,24 @@ jobs: - name: Promote images run: | + set -euo pipefail built_images='${{ inputs.images }}' tag=${{ inputs.image_tag }} for image in $(echo "$built_images" | jq -r '.[]'); do crane cp \ "${INFRA_REPO_URL}/staging/${image}:${tag}" \ "${INFRA_REPO_URL}/stable/${image}:${tag}" - crane cp \ - "${INFRA_REPO_URL}/staging/${image}:latest" \ - "${INFRA_REPO_URL}/stable/${image}:latest" + # latest must be the digest just promoted, not whatever staging:latest is now + crane tag "${INFRA_REPO_URL}/stable/${image}:${tag}" latest + + promoted=$(crane digest "${INFRA_REPO_URL}/stable/${image}:${tag}") + current=$(crane digest "${INFRA_REPO_URL}/stable/${image}:latest") + if [[ "${promoted}" != "${current}" ]]; then + echo "::error::stable/${image}:latest (${current}) != :${tag} (${promoted})" + exit 1 + fi - echo "Promoted image ${image} to stable" + echo "Promoted image ${image} to stable as ${tag} + latest" done - name: Promote charts