From c31bc796d73de4007d01d615f66f0b4a4d756bd1 Mon Sep 17 00:00:00 2001 From: David AI Date: Mon, 6 Jul 2026 13:20:34 +0000 Subject: [PATCH] chore: pin overlay images to immutable sha- tags Replace floating dev/staging/prod tags with a sha-0000000 placeholder in each overlay's kustomization.yaml. Floating tags let ArgoCD sync whatever currently has that name in GHCR, which is non-reproducible and makes rollback ambiguous. CI (bump-dev-overlay / promote.yml) is now the only thing expected to update this value, via 'kustomize edit set image'. Placeholder will be replaced by a real digest on the first successful CI run. --- apps/sample-app/overlays/dev/kustomization.yaml | 6 +++++- apps/sample-app/overlays/prod/kustomization.yaml | 6 +++++- apps/sample-app/overlays/staging/kustomization.yaml | 6 +++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/apps/sample-app/overlays/dev/kustomization.yaml b/apps/sample-app/overlays/dev/kustomization.yaml index 593b211..a07e35b 100644 --- a/apps/sample-app/overlays/dev/kustomization.yaml +++ b/apps/sample-app/overlays/dev/kustomization.yaml @@ -15,5 +15,9 @@ patches: path: /spec/template/spec/containers/0/env/0/value value: dev images: + # Pinned to an immutable sha- tag, never a floating name (dev/staging/prod). + # CI (ci.yml's bump-dev-overlay job, or promote.yml for staging/prod) is the only + # thing that should change this value, via `kustomize edit set image`. + # Placeholder below until the first successful CI run pins a real digest. - name: ghcr.io/david-uka/sample-app - newTag: dev + newTag: sha-0000000 diff --git a/apps/sample-app/overlays/prod/kustomization.yaml b/apps/sample-app/overlays/prod/kustomization.yaml index f57279f..2ea4222 100644 --- a/apps/sample-app/overlays/prod/kustomization.yaml +++ b/apps/sample-app/overlays/prod/kustomization.yaml @@ -21,5 +21,9 @@ patches: path: /spec/template/spec/containers/0/resources/limits/memory value: 256Mi images: + # Pinned to an immutable sha- tag, never a floating name (dev/staging/prod). + # CI (ci.yml's bump-dev-overlay job, or promote.yml for staging/prod) is the only + # thing that should change this value, via `kustomize edit set image`. + # Placeholder below until the first successful CI run pins a real digest. - name: ghcr.io/david-uka/sample-app - newTag: prod + newTag: sha-0000000 diff --git a/apps/sample-app/overlays/staging/kustomization.yaml b/apps/sample-app/overlays/staging/kustomization.yaml index b055238..a9d8d21 100644 --- a/apps/sample-app/overlays/staging/kustomization.yaml +++ b/apps/sample-app/overlays/staging/kustomization.yaml @@ -15,5 +15,9 @@ patches: path: /spec/template/spec/containers/0/env/0/value value: staging images: + # Pinned to an immutable sha- tag, never a floating name (dev/staging/prod). + # CI (ci.yml's bump-dev-overlay job, or promote.yml for staging/prod) is the only + # thing that should change this value, via `kustomize edit set image`. + # Placeholder below until the first successful CI run pins a real digest. - name: ghcr.io/david-uka/sample-app - newTag: staging + newTag: sha-0000000