deploy: staging pins for e30d51de (images.yml GH013) by echobt · Pull Request #245 · CortexLM/cortex

echobt · 2026-09-08T20:00:27Z

Why

images.yml on main keeps building GHCR digests then failing update · commit staging pins with GH013. Latest miss: e30d51de (#250, run 34302039784).

Staging on main is still 1dd07f74 (2026-09-05). Prod pins were not touched.

What changed

deploy/digests/e30d51de889b572cdf1698fc8fef2d85ab1b9f94.json
deploy/pins/staging.json commit_sha → e30d51de…
previous is the complete 1dd07f74 current set
images.yml snapshots that release once before the promote loop and writes it back after

Service	Current (`e30d51de`)	Previous (`1dd07f74`)
validator	`sha256:23a5d86e…`	`sha256:1b95fe82…`
gateway	`sha256:8010ffac…`	`sha256:fa8b73b7…`
updater	`sha256:5bc476b8…`	`sha256:4f0cf422…`
bounty-challenge	`sha256:5243e7be…`	`sha256:624c1d1e…`
proof-challenge	`sha256:f32e28cc…`	`sha256:2541d0af…`

This does not bump config/proof-pin.toml / proof-eval sha256:057a42ef….

Greptile

Greptile has reviewed this PR; findings are fixed or answered (5/5 on 2eed8986)
If the bot was silent, I commented @greptileai review

Test plan

Digests from the green images build (not invented)
staging.json commit_sha == e30d51de…
previous is the full 1dd07f74 service set
prod.json unchanged
CI green on 2eed8986
After merge: deploy-staging can match staging pins to this SHA

Risk

Staging pin ladder only. No emission, no BASE_* rename, no invented sha256.

Naming

I did not rename BASE_* environment variables, deployed host paths, GHCR package names, or base-*-v1 cryptographic domain tags.

greptile-apps · 2026-09-08T20:06:26Z

Greptile Summary

Updates the staging release record to e30d51de, pins all active services to its immutable image digests, and retains the complete 1dd07f74 release as the rollback snapshot.

Confidence Score: 5/5

Safe to merge; no outstanding issues require changes.

The previous rollback-snapshot issue is fully fixed: the current staging record preserves all five services from the complete 1dd07f74 release as the rollback state.

_{Reviews (7): Last reviewed commit: "deploy: staging pins for e30d51de889b572..." | Re-trigger Greptile}

greptile-apps · 2026-09-08T20:06:29Z

+    "commit_sha": "4252130c268672d8804b65a46900bd6530f71d1a",
    "services": {
      "bounty-challenge": {
-        "digest": "sha256:624c1d1e98605d1885460a90373351d49c4a5f6ed242827a4d2673124e7a75d3",
-        "image": "ghcr.io/cortexlm/cortex/bounty-challenge@sha256:624c1d1e98605d1885460a90373351d49c4a5f6ed242827a4d2673124e7a75d3",
+        "digest": "sha256:b5e208efbfe15f5d4d5933ac504620ab5f97c261b832cebb8a61a92ddc36e670",
+        "image": "ghcr.io/cortexlm/cortex/bounty-challenge@sha256:b5e208efbfe15f5d4d5933ac504620ab5f97c261b832cebb8a61a92ddc36e670",
        "repository": "ghcr.io/cortexlm/cortex/bounty-challenge"
      },
      "gateway": {
-        "digest": "sha256:fa8b73b7f696a18cbda31db76ee2524eb95e97a44316be6109a000316ef662a1",
-        "image": "ghcr.io/cortexlm/cortex/gateway@sha256:fa8b73b7f696a18cbda31db76ee2524eb95e97a44316be6109a000316ef662a1",
+        "digest": "sha256:212c2d08d4f9fb42f1553e31abd34ab21441edbaeb31d430c4b17026620e23a9",
+        "image": "ghcr.io/cortexlm/cortex/gateway@sha256:212c2d08d4f9fb42f1553e31abd34ab21441edbaeb31d430c4b17026620e23a9",
        "repository": "ghcr.io/cortexlm/cortex/gateway"
      },
      "proof-challenge": {
-        "digest": "sha256:5bd900e46503f8054f75e15b01324f2bfb472eb1feab90ada173b250270f77d3",
-        "image": "ghcr.io/cortexlm/cortex/proof-challenge@sha256:5bd900e46503f8054f75e15b01324f2bfb472eb1feab90ada173b250270f77d3",
+        "digest": "sha256:2541d0afd0fc492b031bc472756555f13957f6c8d1a85a9ab7f5902cdc639821",
+        "image": "ghcr.io/cortexlm/cortex/proof-challenge@sha256:2541d0afd0fc492b031bc472756555f13957f6c8d1a85a9ab7f5902cdc639821",
        "repository": "ghcr.io/cortexlm/cortex/proof-challenge"
      },
      "updater": {
-        "digest": "sha256:4f0cf422dc8be9f96b31d1c470e302da97a0054e812815ac444c5593a0006c02",
-        "image": "ghcr.io/cortexlm/cortex/updater@sha256:4f0cf422dc8be9f96b31d1c470e302da97a0054e812815ac444c5593a0006c02",
+        "digest": "sha256:9a962fdb3e10c83e242e531f78e15d83e35fe741ffa9113cfe55cd682f6f7700",
+        "image": "ghcr.io/cortexlm/cortex/updater@sha256:9a962fdb3e10c83e242e531f78e15d83e35fe741ffa9113cfe55cd682f6f7700",
        "repository": "ghcr.io/cortexlm/cortex/updater"
      },
      "validator": {
-        "digest": "sha256:1b95fe826688313d895cd7fe8e635f3e44f3a1bbcd7aa8b6664f23ba8973f9e5",
-        "image": "ghcr.io/cortexlm/cortex/validator@sha256:1b95fe826688313d895cd7fe8e635f3e44f3a1bbcd7aa8b6664f23ba8973f9e5",
+        "digest": "sha256:56a4d3be0bd3444f83e4baf700e579467bf2818521200041a82a54eb85dea575",
+        "image": "ghcr.io/cortexlm/cortex/validator@sha256:56a4d3be0bd3444f83e4baf700e579467bf2818521200041a82a54eb85dea575",
        "repository": "ghcr.io/cortexlm/cortex/validator"
      }
    },
-    "updated_at": "2026-09-05T08:09:25Z"
+    "updated_at": "2026-09-08T19:59:59Z"


Preserve rollback snapshot

The previous snapshot records the current 4252130c release for validator, gateway, updater, and bounty-challenge instead of the preceding 1dd07f74 release. The rollback helper restores this snapshot verbatim, so rolling back staging restores only proof-challenge to the old image while leaving the other four services on the new release. This creates a mixed deployment rather than restoring the prior known-good release.

Knowledge Base Used:

Deployment, runtime operations, and image updates

Deployment automation and infrastructure

Artifacts

Evidence from the check

The authored script copies the repository to a temporary directory, invokes the rollback with backup skipped, and compares all restored pins to the preceding manifest; it safely exercises the real helper without modifying the checkout.

Command output from the check

The executed manifest comparison shows the current previous snapshot has four current 4252130 service pins and only an older proof-challenge pin, while the parent manifest is 1dd07f7.

Command output from the check

The real rollback execution in an isolated copy completed with --skip-backup and shows four digest mismatches against 1dd07f7, proving the rollback is a mixed release.

_{Ran code and verified through T-Rex}

cursor · 2026-09-08T20:14:23Z

@greptileai review

P1 rollback snapshot is addressed in 24ef9ce: previous is the full 1dd07f74 service set, and images.yml captures that release once before the promote loop.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-08T21:52:33Z

@greptileai review

Retargeted to f013abbc (#246). previous is still the complete 1dd07f74 staging release (all five services). Digests from images run 34281980177.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-08T22:41:41Z

@greptileai review

Retargeted to 890ce5b3 (#247). previous is still the complete 1dd07f74 staging release. Digests from images run 34286333214.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-09T01:07:42Z

@greptileai review

Retargeted to c0ce0949 (#252), skipping stale f6e50124 (#248) so the PR matches current main. previous is still the complete 1dd07f74 staging release. Digests from images run 34297422117.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-09T01:39:08Z

@greptileai review

Retargeted to 85ab2b70 (#251). previous is still the complete 1dd07f74 staging release. Digests from images run 34299348722.

images.yml built GHCR digests on main then could not push the pin commit (GH013: PRs required + Greptile). Land the same promote via PR. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Sequential promote.sh calls were snapshotting previous per service, so rollback of 4252130 would restore a mixed pin set. Capture the 1dd07f7 release once and write it back after the promote loop. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #250. Digests from images run 34302039784. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-09T02:19:06Z

@greptileai review

Retargeted to e30d51de (#250). previous is still the complete 1dd07f74 staging release. Digests from images run 34302039784.

greptile-apps Bot reviewed Sep 8, 2026

View reviewed changes

cursor Bot pushed a commit that referenced this pull request Sep 8, 2026

deploy: staging pins for f013abb

c4de49f

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from 24ef9ce to c4de49f Compare September 8, 2026 21:52

cursor Bot changed the title ~~deploy: staging pins for 4252130c (images.yml GH013)~~ deploy: staging pins for f013abbc (images.yml GH013) Sep 8, 2026

cursor Bot pushed a commit that referenced this pull request Sep 8, 2026

deploy: staging pins for f013abb

8150a42

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot pushed a commit that referenced this pull request Sep 8, 2026

deploy: staging pins for 890ce5b

7288312

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from c4de49f to 7288312 Compare September 8, 2026 22:41

cursor Bot changed the title ~~deploy: staging pins for f013abbc (images.yml GH013)~~ deploy: staging pins for 890ce5b3 (images.yml GH013) Sep 8, 2026

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for f013abb

c52e156

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for 890ce5b

aba9bd3

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from 7288312 to a72840a Compare September 9, 2026 01:07

cursor Bot changed the title ~~deploy: staging pins for 890ce5b3 (images.yml GH013)~~ deploy: staging pins for c0ce0949 (images.yml GH013) Sep 9, 2026

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for f013abb

21d4940

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for 890ce5b

eba57be

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from a72840a to 52becba Compare September 9, 2026 01:38

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for 85ab2b7

52becba

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot changed the title ~~deploy: staging pins for c0ce0949 (images.yml GH013)~~ deploy: staging pins for 85ab2b70 (images.yml GH013) Sep 9, 2026

cursoragent and others added 5 commits September 9, 2026 02:18

deploy: staging pins for 4252130

9b2ad91

images.yml built GHCR digests on main then could not push the pin commit (GH013: PRs required + Greptile). Land the same promote via PR. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for f013abb

25ee5bd

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for 890ce5b

35d6e3d

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for c0ce094

23bb299

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursoragent and others added 2 commits September 9, 2026 02:18

deploy: staging pins for 85ab2b7

e51002f

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for e30d51d

2eed898

Retarget #245: main moved to #250. Digests from images run 34302039784. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from 52becba to 2eed898 Compare September 9, 2026 02:18

cursor Bot changed the title ~~deploy: staging pins for 85ab2b70 (images.yml GH013)~~ deploy: staging pins for e30d51de (images.yml GH013) Sep 9, 2026

Navigation Menu

Uh oh!

deploy: staging pins for e30d51de (images.yml GH013) - #245

deploy: staging pins for e30d51de (images.yml GH013)#245
echobt wants to merge 7 commits into
mainfrom
cursor/staging-pins-4252130c-d65e

echobt commented Sep 8, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

echobt commented Sep 8, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Greptile

Test plan

Risk

Naming

Uh oh!

greptile-apps Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Uh oh!

greptile-apps Bot Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

echobt commented Sep 8, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Sep 8, 2026 •

edited

Loading