Skip to content

chore: update image pins #629

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
OisinKyne merged 1 commit into from
Jun 12, 2026
Merged

chore: update image pins #629

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions internal/embed/infrastructure/base/templates/llm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,14 +303,14 @@ spec:
- name: x402-buyer
# Pinned by sha256 digest (multi-arch manifest list, amd64+arm64)
# so the deployed sidecar is byte-for-byte identical across QA
# hosts. The :8ebec92 tag is preserved for human readability; the
# hosts. The :d16d167 tag is preserved for human readability; the
# digest is authoritative.
# Previous tag-only pin allowed the local-build path to silently
# reuse a 5-day-old `:latest` image and ate the release-smoke 503
# investigation: stale buyer serialized X-PAYMENT with empty
# authorization fields → facilitator /verify 400 → 503 cascade
# across flow-08/11/14/13. See internal/embed/embed_image_pin_test.go.
image: ghcr.io/obolnetwork/x402-buyer:8ebec92@sha256:b9d277350667b92a62de10b8e22d2bf266eeabd7d713fa46cc73e233f3918983
image: ghcr.io/obolnetwork/x402-buyer:d16d167@sha256:3e45377eff12474f1ae65a8514cf8d75375bcf84e649a6c25b7cae0c350a803f
imagePullPolicy: IfNotPresent
# PSS Restricted + writable PVC. On fresh clusters the StorageClass
# asks local-path-provisioner for local PVs, so kubelet applies the
Expand Down
4 changes: 2 additions & 2 deletions internal/embed/infrastructure/base/templates/x402.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,7 +255,7 @@ spec:
type: RuntimeDefault
containers:
- name: verifier
image: ghcr.io/obolnetwork/x402-verifier:8ebec92@sha256:079322ffcac158ced5bb4c891a3ccca8a9a622edf3b08866252d4c3b7d556d4a
image: ghcr.io/obolnetwork/x402-verifier:d16d167@sha256:1d501bbaa14cd3bfc37cffa47c1c8d19a5743e86cb6066bc73f3197b89ca0abf
imagePullPolicy: IfNotPresent
# PSS Restricted: per-container hardening. Verifier is a Go binary
# reading two RO ConfigMaps; no writeable rootfs paths required.
Expand Down Expand Up @@ -357,7 +357,7 @@ spec:
# bug; b39bcaa (post-rc10 main) carries it, and also ships PR #590's
# actionable pending-registration status message.
# See TestServiceOfferControllerImage_CarriesSecretCreateOnlyFix.
image: ghcr.io/obolnetwork/serviceoffer-controller:8ebec92@sha256:f6d73260d7425b6b967c1c39672afbd47c08fa0ce86fbfb985e75da26bf39b4e
image: ghcr.io/obolnetwork/serviceoffer-controller:d16d167@sha256:ab2bc596b0c2b40664519d01e37aea349a6df22dd1b4ed5e44c1c9e1fcf89519
imagePullPolicy: IfNotPresent
securityContext:
allowPrivilegeEscalation: false
Expand Down
Loading