Problem
The operator chart pins the injected AuthBridge images (authbridge, authbridge-envoy, authbridge-lite, proxy-init) at :latest in charts/operator/values.yaml. The release workflow (.github/workflows/release.yml) only pins the controller-manager image (yq … .controllerManager.container.image.tag = version) — it never touches the injected images. So every published operator-chart (the whole 0.3 RC line: rc.1/rc.2/rc.3) shipped :latest for the AuthBridge images.
Non-reproducible, and against the no-:latest-in-release rule. It was invisible to both repos' pin checks (see rossoctl companion issue).
What was done for v0.7.0 (symptom fix only)
release-0.3 values.yaml was hand-pinned :latest → ghcr.io/rossoctl/cortex/authbridge*:v0.6.0 (commit on release-0.3), so the shipped v0.3.0 chart and the v0.7.0 platform are clean. This did not fix the process or main.
Fix (this issue)
- Pin the injected images in
main's values.yaml too (so future releases don't regress), and/or
- Have
release.yml pin the injected images to a release-appropriate cortex tag, or fail the build if any injected image is :latest.
Timing
Resolve early in 0.8 — before the first 0.8 operator RC — otherwise the 0.8 RCs regress to :latest and require hand-pinning again.
Assisted-By: Claude Code
Problem
The operator chart pins the injected AuthBridge images (
authbridge,authbridge-envoy,authbridge-lite,proxy-init) at:latestincharts/operator/values.yaml. The release workflow (.github/workflows/release.yml) only pins the controller-manager image (yq … .controllerManager.container.image.tag = version) — it never touches the injected images. So every publishedoperator-chart(the whole 0.3 RC line: rc.1/rc.2/rc.3) shipped:latestfor the AuthBridge images.Non-reproducible, and against the no-
:latest-in-release rule. It was invisible to both repos' pin checks (see rossoctl companion issue).What was done for v0.7.0 (symptom fix only)
release-0.3values.yamlwas hand-pinned:latest → ghcr.io/rossoctl/cortex/authbridge*:v0.6.0(commit on release-0.3), so the shipped v0.3.0 chart and the v0.7.0 platform are clean. This did not fix the process ormain.Fix (this issue)
main'svalues.yamltoo (so future releases don't regress), and/orrelease.ymlpin the injected images to a release-appropriate cortex tag, or fail the build if any injected image is:latest.Timing
Resolve early in 0.8 — before the first 0.8 operator RC — otherwise the 0.8 RCs regress to
:latestand require hand-pinning again.Assisted-By: Claude Code