deploy: staging pins for a8b90181 (images.yml GH013) by echobt · Pull Request #245 · CortexLM/cortex

echobt · 2026-09-08T20:00:27Z

Why

images.yml on main keeps building GHCR digests then failing update · commit staging pins with GH013. Latest miss: a8b90181 (#253, run 34373475123).

Staging on main is still 1dd07f74 (2026-09-05). Prod pins were not touched.

Separately, deploy staging master/validator on that SHA failed opening the DigitalOcean base-hosts firewall: HTTP 422 must have no more than 50 rules. That is leftover ephemeral /32 SSH rules, not a pin-file bug. This PR does not touch DO firewalls.

What changed

deploy/digests/a8b9018134a3e7b5446514ab48a937882b0f0a63.json
deploy/pins/staging.json commit_sha → a8b90181…
previous is the complete 1dd07f74 current set
images.yml snapshots that release once before the promote loop and writes it back after

Service	Current (`a8b90181`)	Previous (`1dd07f74`)
validator	`sha256:650bfe48…`	`sha256:1b95fe82…`
gateway	`sha256:17ded01b…`	`sha256:fa8b73b7…`
updater	`sha256:e42a763e…`	`sha256:4f0cf422…`
bounty-challenge	`sha256:cdc9696f…`	`sha256:624c1d1e…`
proof-challenge	`sha256:b7a33f89…`	`sha256:2541d0af…`

This does not bump config/proof-pin.toml / proof-eval sha256:057a42ef….

Greptile

Greptile has reviewed this PR; findings are fixed or answered (5/5 on a3ff63ea)
If the bot was silent, I commented @greptileai review

Test plan

Digests from the green images build (not invented)
staging.json commit_sha == a8b90181…
previous is the full 1dd07f74 service set
prod.json unchanged
CI green on a3ff63ea
After merge: deploy-staging can match staging pins to this SHA (also needs the DO firewall rule cap cleared)

Risk

Staging pin ladder only. No emission, no BASE_* rename, no invented sha256.

Naming

I did not rename BASE_* environment variables, deployed host paths, GHCR package names, or base-*-v1 cryptographic domain tags.

greptile-apps · 2026-09-08T20:06:26Z

Greptile Summary

Summary

Retargets staging to the immutable images built for a8b90181.
Preserves the full 1dd07f74 staging release as the rollback snapshot across all five services.

Merge safety

Safe to merge. The rollback path now restores a consistent prior release.

Confidence Score: 5/5

Safe to merge.

No new actionable findings remain. The previously reported rollback-snapshot issue is fully fixed: the current staging pin retains all five services from the prior 1dd07f74 release, so rollback restores one consistent release instead of a mixed deployment.

_{Reviews (8): Last reviewed commit: "deploy: staging pins for a8b9018134a3e7b..." | Re-trigger Greptile}

cursor · 2026-09-08T20:14:23Z

@greptileai review

P1 rollback snapshot is addressed in 24ef9ce: previous is the full 1dd07f74 service set, and images.yml captures that release once before the promote loop.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-08T21:52:33Z

@greptileai review

Retargeted to f013abbc (#246). previous is still the complete 1dd07f74 staging release (all five services). Digests from images run 34281980177.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-08T22:41:41Z

@greptileai review

Retargeted to 890ce5b3 (#247). previous is still the complete 1dd07f74 staging release. Digests from images run 34286333214.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-09T01:07:42Z

@greptileai review

Retargeted to c0ce0949 (#252), skipping stale f6e50124 (#248) so the PR matches current main. previous is still the complete 1dd07f74 staging release. Digests from images run 34297422117.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-09T01:39:08Z

@greptileai review

Retargeted to 85ab2b70 (#251). previous is still the complete 1dd07f74 staging release. Digests from images run 34299348722.

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #250. Digests from images run 34302039784. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-09T02:19:06Z

@greptileai review

Retargeted to e30d51de (#250). previous is still the complete 1dd07f74 staging release. Digests from images run 34302039784.

images.yml built GHCR digests on main then could not push the pin commit (GH013: PRs required + Greptile). Land the same promote via PR. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Sequential promote.sh calls were snapshotting previous per service, so rollback of 4252130 would restore a mixed pin set. Capture the 1dd07f7 release once and write it back after the promote loop. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #250. Digests from images run 34302039784. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

Retarget #245: main moved to #253. Digests from images run 34373475123. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor · 2026-09-09T16:08:18Z

@greptileai review

Retargeted to a8b90181 (#253). previous is still the complete 1dd07f74 staging release. Digests from images run 34373475123.

greptile-apps Bot reviewed Sep 8, 2026

View reviewed changes

Comment thread deploy/pins/staging.json Outdated

cursor Bot pushed a commit that referenced this pull request Sep 8, 2026

deploy: staging pins for f013abb

c4de49f

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from 24ef9ce to c4de49f Compare September 8, 2026 21:52

cursor Bot changed the title ~~deploy: staging pins for 4252130c (images.yml GH013)~~ deploy: staging pins for f013abbc (images.yml GH013) Sep 8, 2026

cursor Bot pushed a commit that referenced this pull request Sep 8, 2026

deploy: staging pins for f013abb

8150a42

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot pushed a commit that referenced this pull request Sep 8, 2026

deploy: staging pins for 890ce5b

7288312

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from c4de49f to 7288312 Compare September 8, 2026 22:41

cursor Bot changed the title ~~deploy: staging pins for f013abbc (images.yml GH013)~~ deploy: staging pins for 890ce5b3 (images.yml GH013) Sep 8, 2026

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for f013abb

c52e156

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for 890ce5b

aba9bd3

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from 7288312 to a72840a Compare September 9, 2026 01:07

cursor Bot changed the title ~~deploy: staging pins for 890ce5b3 (images.yml GH013)~~ deploy: staging pins for c0ce0949 (images.yml GH013) Sep 9, 2026

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for f013abb

21d4940

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for 890ce5b

eba57be

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from a72840a to 52becba Compare September 9, 2026 01:38

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for 85ab2b7

52becba

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot changed the title ~~deploy: staging pins for c0ce0949 (images.yml GH013)~~ deploy: staging pins for 85ab2b70 (images.yml GH013) Sep 9, 2026

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for f013abb

25ee5bd

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from 52becba to 2eed898 Compare September 9, 2026 02:18

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for 890ce5b

35d6e3d

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for 85ab2b7

e51002f

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot pushed a commit that referenced this pull request Sep 9, 2026

deploy: staging pins for e30d51d

2eed898

Retarget #245: main moved to #250. Digests from images run 34302039784. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot changed the title ~~deploy: staging pins for 85ab2b70 (images.yml GH013)~~ deploy: staging pins for e30d51de (images.yml GH013) Sep 9, 2026

cursoragent and others added 8 commits September 9, 2026 16:08

deploy: staging pins for 4252130

d2dc37f

images.yml built GHCR digests on main then could not push the pin commit (GH013: PRs required + Greptile). Land the same promote via PR. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for f013abb

35edf56

Retarget #245: main moved to #246. Digests from images run 34281980177. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for 890ce5b

14c9f80

Retarget #245: main moved to #247. Digests from images run 34286333214. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for c0ce094

4686537

Retarget #245: main moved through #248/#252. Digests from images run 34297422117. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for 85ab2b7

631bd99

Retarget #245: main moved to #251. Digests from images run 34299348722. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for e30d51d

e9bbff4

Retarget #245: main moved to #250. Digests from images run 34302039784. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

deploy: staging pins for a8b9018

a3ff63e

Retarget #245: main moved to #253. Digests from images run 34373475123. previous stays the full 1dd07f7 staging release. Co-authored-by: Mathis <echobt@users.noreply.github.com>

cursor Bot force-pushed the cursor/staging-pins-4252130c-d65e branch from 2eed898 to a3ff63e Compare September 9, 2026 16:08

cursor Bot changed the title ~~deploy: staging pins for e30d51de (images.yml GH013)~~ deploy: staging pins for a8b90181 (images.yml GH013) Sep 9, 2026

echobt merged commit 190e976 into main Sep 9, 2026
5 checks passed

echobt deleted the cursor/staging-pins-4252130c-d65e branch September 9, 2026 16:17

echobt mentioned this pull request Sep 9, 2026

deploy: staging pins for af6bec9a (images.yml GH013) #257

Open

7 tasks

Navigation Menu

Uh oh!

deploy: staging pins for a8b90181 (images.yml GH013) - #245

deploy: staging pins for a8b90181 (images.yml GH013)#245
echobt merged 8 commits into
mainfrom
cursor/staging-pins-4252130c-d65e

echobt commented Sep 8, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

echobt commented Sep 8, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Greptile

Test plan

Risk

Naming

Uh oh!

greptile-apps Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Summary

Merge safety

Confidence Score: 5/5

Uh oh!

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

echobt commented Sep 8, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Sep 8, 2026 •

edited

Loading