From c9fe171e53a8352e09b7a84bc1b3ea61746af79e Mon Sep 17 00:00:00 2001
From: Alexander Dorn <ad@not.one>
Date: Wed, 6 May 2026 20:35:03 +0200
Subject: [PATCH] fix(examples/03-immich): pin valid postgres image tag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The canonical Immich walkthrough referenced
`Image=ghcr.io/immich-app/postgres:16`, which does not exist on
ghcr.io/immich-app/postgres. `core-ops apply --source-repo
examples/03-immich --host example` failed end-to-end on a clean
host with:

  Error: unable to copy from source docker://ghcr.io/immich-app/postgres:16:
    initializing source docker://ghcr.io/immich-app/postgres:16:
    reading manifest 16 in ghcr.io/immich-app/postgres: manifest unknown

Pin to `16-vectorchord0.3.0-pgvector0.8.0-pgvectors0.2.0` — a real,
fully-qualified tag that exists on the registry and matches the
unit's `Description=Immich Postgres + pgvecto.rs database` (the
chosen tag includes the pgvecto.rs / pgvectors extension). This is
the closest 16-major build to Immich's officially recommended
14-line in their compose template.

The bump to `2.2.1` is required: modifications under `examples/`
trigger `unclassified_path_releasable_default` (patch). The
provenance-state fixture is bumped in lock-step so
`controller_version_provenance_matches_cargo_package_version`
remains green.

Discovered while exercising the canonical walkthrough for spec/018
(adoption-readiness); spec/018's recording task was blocked on
this end-to-end failure.

Verification:
$ cargo test                                                                  472 passed
$ cargo clippy --all-targets -- -D warnings                                   clean
$ cargo run --bin core-ops-release -- validate --base-ref master              passed (patch)
$ ssh core@<uat> 'sudo podman manifest inspect ghcr.io/immich-app/postgres:16-vectorchord0.3.0-pgvector0.8.0-pgvectors0.2.0'   resolves

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                               | 3 +++
 Cargo.lock                                                 | 2 +-
 Cargo.toml                                                 | 2 +-
 changes/fix-immich-postgres-image-tag.md                   | 7 +++++++
 .../immich-database/quadlet/immich-database.container      | 2 +-
 tests/fixtures/provenance_state/valid-success.json         | 2 +-
 6 files changed, 14 insertions(+), 4 deletions(-)
 create mode 100644 changes/fix-immich-postgres-image-tag.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0fd63ef..acaa6a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,9 @@ versioning for public release policy decisions.
 ## [Unreleased]
 
 <!-- core-ops-release:start -->
+### Changed
+
+- Fix `examples/03-immich` postgres image tag (`:16` -> `:16-vectorchord0.3.0-pgvector0.8.0-pgvectors0.2.0`); the previous tag did not exist on `ghcr.io/immich-app/postgres` and prevented the canonical Immich walkthrough from applying end-to-end on a clean host.
 <!-- core-ops-release:end -->
 
 ## [2.2.0] - 2026-05-06
diff --git a/Cargo.lock b/Cargo.lock
index ed696d2..32a352c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -157,7 +157,7 @@ checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "core-ops"
-version = "2.2.0"
+version = "2.2.1"
 dependencies = [
  "clap",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index 012e7bf..4342c47 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "core-ops"
-version = "2.2.0"
+version = "2.2.1"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 
diff --git a/changes/fix-immich-postgres-image-tag.md b/changes/fix-immich-postgres-image-tag.md
new file mode 100644
index 0000000..e97172b
--- /dev/null
+++ b/changes/fix-immich-postgres-image-tag.md
@@ -0,0 +1,7 @@
+---
+change_id: fix-immich-postgres-image-tag
+release_intent: patch
+summary: Fix `examples/03-immich` postgres image tag (`:16` -> `:16-vectorchord0.3.0-pgvector0.8.0-pgvectors0.2.0`); the previous tag did not exist on `ghcr.io/immich-app/postgres` and prevented the canonical Immich walkthrough from applying end-to-end on a clean host.
+scope: examples
+release_preparation: false
+---
diff --git a/examples/03-immich/services/immich-database/quadlet/immich-database.container b/examples/03-immich/services/immich-database/quadlet/immich-database.container
index 8afbead..4b621d5 100644
--- a/examples/03-immich/services/immich-database/quadlet/immich-database.container
+++ b/examples/03-immich/services/immich-database/quadlet/immich-database.container
@@ -4,7 +4,7 @@ After=network-online.target
 Wants=network-online.target
 
 [Container]
-Image=ghcr.io/immich-app/postgres:16
+Image=ghcr.io/immich-app/postgres:16-vectorchord0.3.0-pgvector0.8.0-pgvectors0.2.0
 ContainerName=immich-database
 Network=immich-internal.network
 Volume=immich-db-data.volume:/var/lib/postgresql/data:Z
diff --git a/tests/fixtures/provenance_state/valid-success.json b/tests/fixtures/provenance_state/valid-success.json
index ef397df..e28c547 100644
--- a/tests/fixtures/provenance_state/valid-success.json
+++ b/tests/fixtures/provenance_state/valid-success.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "controller": {
-    "version": "2.2.0",
+    "version": "2.2.1",
     "revision": "8f3c2ab",
     "build_time": "2026-03-23T10:00:00Z",
     "tree_state": "clean"