fix(ci): confirm publication visibility and pin Kustomize #5

Merged

morten-olsen merged 1 commit from fix/aed0777d-publication-validation into main

2026-10-29 22:37:28 +01:00

morten-olsen commented

2026-10-29 22:32:04 +01:00

Owner

Summary

Prior-stage image/release metadata can briefly return 404 after a successful publisher. Confirm visibility with six bounded read-only lookups; keep overwrite refusal and fail immediately on permission, rate-limit and transport errors. Use the existing Makefile-pinned Kustomize instead of the latest-release installer.

successful prior job → bounded visibility check → next publisher
existing artifact / lookup error → stop

Evidence

Before: HOMEIT-434 reproduced transient metadata absence; DNS stamping regression failed against the omitted environment.
After: local release regressions pass (33 per operator; DNS 34). Pinned Kustomize 5.7.1 installs successfully. DNS corrected real chart passes Helm lint/render and cluster server dry-run. Exact-head hosted checks are followed before merge.

Merge danger

Door: two-way. Revert restores workflow behavior; it does not undo previously published artifacts.

Blast radius: pipeline. Main runs safety/probe checks only; this merge creates no release and changes no workload pin, credential, permission or network access.

Rollback and verification

Roll back: revert this commit; never move/delete consumed tags or overwrite artifacts.
Verify after rollout: exact PR/main checks and mirror probes green; source/mirror match; live workload pins and pod digests unchanged. Positive publication requires exact version/SHA approval.
Reviewers: owner self-review; Morten explicitly directed no additional Security Engineer handoff for this outward-only path.

## Summary Prior-stage image/release metadata can briefly return 404 after a successful publisher. Confirm visibility with six bounded read-only lookups; keep overwrite refusal and fail immediately on permission, rate-limit and transport errors. Use the existing Makefile-pinned Kustomize instead of the latest-release installer. ```text successful prior job → bounded visibility check → next publisher existing artifact / lookup error → stop ``` ## Evidence - **Before:** HOMEIT-434 reproduced transient metadata absence; DNS stamping regression failed against the omitted environment. - **After:** local release regressions pass (33 per operator; DNS 34). Pinned Kustomize 5.7.1 installs successfully. DNS corrected real chart passes Helm lint/render and cluster server dry-run. Exact-head hosted checks are followed before merge. ## Merge danger **Door:** two-way. Revert restores workflow behavior; it does not undo previously published artifacts. **Blast radius:** pipeline. Main runs safety/probe checks only; this merge creates no release and changes no workload pin, credential, permission or network access. ## Rollback and verification - **Roll back:** revert this commit; never move/delete consumed tags or overwrite artifacts. - **Verify after rollout:** exact PR/main checks and mirror probes green; source/mirror match; live workload pins and pod digests unchanged. Positive publication requires exact version/SHA approval. - **Reviewers:** owner self-review; Morten explicitly directed no additional Security Engineer handoff for this outward-only path.

morten-olsen added 1 commit

2026-10-29 22:32:04 +01:00