jakman85andClaude Opus 5.5
19097e4d4f
Dispatcher image and PM_WORKER_IMAGE both move to sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2, the digest the registry returns for agent-runner:sha-466f63ec3c3d and :main. config-generation 4 -> 5. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2.1 KiB
2.1 KiB
date, branch, title
| date | branch | title |
|---|---|---|
| 2026-10-31 | chore/pm-agent-digest-99 | Pin pm-agent dispatcher and worker to the agent-runner digest built from PR |
What changed
platform/pm-agent/deployment.yaml: the dispatcherimage:moves fromagent-runner@sha256:df36d9b7…(images run 383) toagent-runner@sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2.config-generationgoes from "4" to "5" so the pod rolls.platform/pm-agent/configmap.yaml:PM_WORKER_IMAGEgets the same digest. A comment line records where it came from. The# renovate-digest:marker still sits directly above both values.- No other values changed.
PM_DRY_RUNstays "false".PM_DECISION_MAX_TURNSis not set, so it keeps its in-code default of 1. No*.sops.yamlwas touched.
What I verified
- PR #99's merge commit is
466f63ec3c3df968a1dab25a8811dcd41961efde(origin/main HEAD at branch time). - The Gitea Actions tasks API shows the
imagesworkflow (images.yaml) on that commit as run 394 (task 643), with eventpushand statussuccess. - I resolved the digest read-only from the registry by HEADing the manifests with OCI and
Docker Accept headers. Both
agent-runner:sha-466f63ec3c3dandagent-runner:mainreturned200, anapplication/vnd.oci.image.manifest.v1+jsoncontent type, anddocker-content-digest: sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2. The two are identical. - Toolbox gate: the rc and skipped stages are in the PR description.
What I did NOT verify
- That the dispatcher actually rolls to the new digest after merge, and that Flux applies it.
Flux's
lastAppliedRevisionand the pod's image were not checked. That is post-merge work. - That the new image surfaces the triage failure's real cause. It will show only on the next failing triage, in the dispatcher log.
- That admission (rule 7,
imagePullSecrets) admits worker Jobs from this digest. The template comes frominfra/agent/at PR #99's merge, which still carries theimagePullSecretsentry, but no Job was created to prove it. - I did not run the image's own selftest against this digest.