deploy: staging pins for e30d51de (images.yml GH013)

.github/workflows/images.yml

@@ -229,6 +229,22 @@ jobs:
           cp "$SRC" "deploy/digests/${SHA}.json"
           echo "Recorded digest manifest: deploy/digests/${SHA}.json"
           chmod +x deploy/scripts/promote.sh
+          # Snapshot the full current staging release once. Sequential
+          # promote.sh calls overwrite `previous` per service and would
+          # otherwise leave a mixed rollback (new images + one old).
+          python3 -c '
+          import json
+          p = json.load(open("deploy/pins/staging.json"))
+          prev = {
+              "commit_sha": p.get("commit_sha"),
+              "services": p.get("services") or {},
+              "updated_at": p.get("updated_at"),
+          }
+          with open("/tmp/staging-previous.json", "w", encoding="utf-8") as f:
+              json.dump(prev, f, indent=2, sort_keys=True)
+              f.write("\n")
+          print("captured previous staging release", prev.get("commit_sha"))
+          '
           # Pin services only (validator/gateway/updater/live challenges).
           # --skip-backup: this job records CI digests; Spaces/PG backup runs at
           # prod promote (deploy-prod.yml, fail-closed).
@@ -250,11 +266,18 @@ jobs:
           python3 -c '
           import json, sys
           p = json.load(open("deploy/pins/staging.json"))
+          prev = json.load(open("/tmp/staging-previous.json"))
+          p["previous"] = prev
+          with open("deploy/pins/staging.json", "w", encoding="utf-8") as f:
+              json.dump(p, f, indent=2, sort_keys=True)
+              f.write("\n")
           assert p["commit_sha"] == sys.argv[1], (p["commit_sha"], sys.argv[1])
           for s in ("validator", "gateway", "updater", "bounty-challenge", "proof-challenge"):
               assert s in p["services"], s
               assert p["services"][s]["digest"].startswith("sha256:")
-          print("staging pins ok", p["commit_sha"])
+              assert s in prev["services"], s
+              assert prev["services"][s]["digest"].startswith("sha256:")
+          print("staging pins ok", p["commit_sha"], "previous", prev.get("commit_sha"))
           ' "$SHA"
 
       - name: Commit and push staging pins

deploy/digests/e30d51de889b572cdf1698fc8fef2d85ab1b9f94.json

@@ -0,0 +1,55 @@
+{
+  "commit_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94",
+  "created_at": "2026-09-09T02:14:47Z",
+  "images": {
+    "base-attest-helper": {
+      "commit_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94",
+      "digest": "sha256:5248b63749b605f35555cc52ce560846830ef6f20777c216bb6aab9a62ad5380",
+      "image": "ghcr.io/cortexlm/cortex/base-attest-helper@sha256:5248b63749b605f35555cc52ce560846830ef6f20777c216bb6aab9a62ad5380",
+      "repository": "ghcr.io/cortexlm/cortex/base-attest-helper",
+      "service": "base-attest-helper",
+      "tag_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94"
+    },
+    "bounty-challenge": {
+      "commit_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94",
+      "digest": "sha256:5243e7beb0b945d2111fbe25ec793e71a7e6e55338cc2d068877ebb955db0e0c",
+      "image": "ghcr.io/cortexlm/cortex/bounty-challenge@sha256:5243e7beb0b945d2111fbe25ec793e71a7e6e55338cc2d068877ebb955db0e0c",
+      "repository": "ghcr.io/cortexlm/cortex/bounty-challenge",
+      "service": "bounty-challenge",
+      "tag_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94"
+    },
+    "gateway": {
+      "commit_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94",
+      "digest": "sha256:8010ffac81bb9d2dacce503370f46fab8abb27b9e05237ab4b82d761ec849db5",
+      "image": "ghcr.io/cortexlm/cortex/gateway@sha256:8010ffac81bb9d2dacce503370f46fab8abb27b9e05237ab4b82d761ec849db5",
+      "repository": "ghcr.io/cortexlm/cortex/gateway",
+      "service": "gateway",
+      "tag_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94"
+    },
+    "proof-challenge": {
+      "commit_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94",
+      "digest": "sha256:f32e28cc0dba7dd5d040c6846f8f3a440a0764713e0747351df18cabbf428b07",
+      "image": "ghcr.io/cortexlm/cortex/proof-challenge@sha256:f32e28cc0dba7dd5d040c6846f8f3a440a0764713e0747351df18cabbf428b07",
+      "repository": "ghcr.io/cortexlm/cortex/proof-challenge",
+      "service": "proof-challenge",
+      "tag_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94"
+    },
+    "updater": {
+      "commit_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94",
+      "digest": "sha256:5bc476b8ce22e18ac182427ec80da5ca780f73ce94bbfd47d761d3e11242d379",
+      "image": "ghcr.io/cortexlm/cortex/updater@sha256:5bc476b8ce22e18ac182427ec80da5ca780f73ce94bbfd47d761d3e11242d379",
+      "repository": "ghcr.io/cortexlm/cortex/updater",
+      "service": "updater",
+      "tag_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94"
+    },
+    "validator": {
+      "commit_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94",
+      "digest": "sha256:23a5d86e908a0be8eb7f67de652b88a20d0092b02482cc5aebdbe0f6be02c744",
+      "image": "ghcr.io/cortexlm/cortex/validator@sha256:23a5d86e908a0be8eb7f67de652b88a20d0092b02482cc5aebdbe0f6be02c744",
+      "repository": "ghcr.io/cortexlm/cortex/validator",
+      "service": "validator",
+      "tag_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94"
+    }
+  },
+  "registry": "ghcr.io"
+}

deploy/pins/staging.json

@@ -1,5 +1,5 @@
 {
-  "commit_sha": "1dd07f7484bb6a2bab6f9fcd7c9348f95fec1927",
+  "commit_sha": "e30d51de889b572cdf1698fc8fef2d85ab1b9f94",
   "env": "staging",
   "previous": {
     "commit_sha": "1dd07f7484bb6a2bab6f9fcd7c9348f95fec1927",
@@ -15,8 +15,8 @@
         "repository": "ghcr.io/cortexlm/cortex/gateway"
       },
       "proof-challenge": {
-        "digest": "sha256:5bd900e46503f8054f75e15b01324f2bfb472eb1feab90ada173b250270f77d3",
-        "image": "ghcr.io/cortexlm/cortex/proof-challenge@sha256:5bd900e46503f8054f75e15b01324f2bfb472eb1feab90ada173b250270f77d3",
+        "digest": "sha256:2541d0afd0fc492b031bc472756555f13957f6c8d1a85a9ab7f5902cdc639821",
+        "image": "ghcr.io/cortexlm/cortex/proof-challenge@sha256:2541d0afd0fc492b031bc472756555f13957f6c8d1a85a9ab7f5902cdc639821",
         "repository": "ghcr.io/cortexlm/cortex/proof-challenge"
       },
       "updater": {
@@ -30,34 +30,34 @@
         "repository": "ghcr.io/cortexlm/cortex/validator"
       }
     },
-    "updated_at": "2026-09-05T08:09:25Z"
+    "updated_at": "2026-09-05T08:09:26Z"
   },
   "services": {
     "bounty-challenge": {
-      "digest": "sha256:624c1d1e98605d1885460a90373351d49c4a5f6ed242827a4d2673124e7a75d3",
-      "image": "ghcr.io/cortexlm/cortex/bounty-challenge@sha256:624c1d1e98605d1885460a90373351d49c4a5f6ed242827a4d2673124e7a75d3",
+      "digest": "sha256:5243e7beb0b945d2111fbe25ec793e71a7e6e55338cc2d068877ebb955db0e0c",
+      "image": "ghcr.io/cortexlm/cortex/bounty-challenge@sha256:5243e7beb0b945d2111fbe25ec793e71a7e6e55338cc2d068877ebb955db0e0c",
       "repository": "ghcr.io/cortexlm/cortex/bounty-challenge"
     },
     "gateway": {
-      "digest": "sha256:fa8b73b7f696a18cbda31db76ee2524eb95e97a44316be6109a000316ef662a1",
-      "image": "ghcr.io/cortexlm/cortex/gateway@sha256:fa8b73b7f696a18cbda31db76ee2524eb95e97a44316be6109a000316ef662a1",
+      "digest": "sha256:8010ffac81bb9d2dacce503370f46fab8abb27b9e05237ab4b82d761ec849db5",
+      "image": "ghcr.io/cortexlm/cortex/gateway@sha256:8010ffac81bb9d2dacce503370f46fab8abb27b9e05237ab4b82d761ec849db5",
       "repository": "ghcr.io/cortexlm/cortex/gateway"
     },
     "proof-challenge": {
-      "digest": "sha256:2541d0afd0fc492b031bc472756555f13957f6c8d1a85a9ab7f5902cdc639821",
-      "image": "ghcr.io/cortexlm/cortex/proof-challenge@sha256:2541d0afd0fc492b031bc472756555f13957f6c8d1a85a9ab7f5902cdc639821",
+      "digest": "sha256:f32e28cc0dba7dd5d040c6846f8f3a440a0764713e0747351df18cabbf428b07",
+      "image": "ghcr.io/cortexlm/cortex/proof-challenge@sha256:f32e28cc0dba7dd5d040c6846f8f3a440a0764713e0747351df18cabbf428b07",
       "repository": "ghcr.io/cortexlm/cortex/proof-challenge"
     },
     "updater": {
-      "digest": "sha256:4f0cf422dc8be9f96b31d1c470e302da97a0054e812815ac444c5593a0006c02",
-      "image": "ghcr.io/cortexlm/cortex/updater@sha256:4f0cf422dc8be9f96b31d1c470e302da97a0054e812815ac444c5593a0006c02",
+      "digest": "sha256:5bc476b8ce22e18ac182427ec80da5ca780f73ce94bbfd47d761d3e11242d379",
+      "image": "ghcr.io/cortexlm/cortex/updater@sha256:5bc476b8ce22e18ac182427ec80da5ca780f73ce94bbfd47d761d3e11242d379",
       "repository": "ghcr.io/cortexlm/cortex/updater"
     },
     "validator": {
-      "digest": "sha256:1b95fe826688313d895cd7fe8e635f3e44f3a1bbcd7aa8b6664f23ba8973f9e5",
-      "image": "ghcr.io/cortexlm/cortex/validator@sha256:1b95fe826688313d895cd7fe8e635f3e44f3a1bbcd7aa8b6664f23ba8973f9e5",
+      "digest": "sha256:23a5d86e908a0be8eb7f67de652b88a20d0092b02482cc5aebdbe0f6be02c744",
+      "image": "ghcr.io/cortexlm/cortex/validator@sha256:23a5d86e908a0be8eb7f67de652b88a20d0092b02482cc5aebdbe0f6be02c744",
       "repository": "ghcr.io/cortexlm/cortex/validator"
     }
   },
-  "updated_at": "2026-09-05T08:09:26Z"
+  "updated_at": "2026-09-09T02:18:55Z"
 }