- Shipped
- September 5, 2026 at 5:35 PM UTC
- Author
- Kamo
- Commit
- 79b6d5b
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and the running pods are checked against it. If no pod is running the image this run produced, the build fails instead of reporting success. The tag cannot answer that question — rebuilding the same commit reuses it, so a stale pod and a fresh one carry identical tags. That is precisely why the no-op survived unnoticed: everything a human would check looked right. The digest is resolved from the registry rather than passed down from the build job, which would need an `outputs:` block on that job. Adding one to a job that already had it is how a workflow in this fleet became silently un-runnable earlier today: Forgejo rejects a duplicate mapping key by skipping the workflow entirely — no run, no error, just a repository that quietly stops building. Keeping the whole check inside the existing shell block avoids that class of failure completely. Fails OPEN when the registry or the pod list is unreachable. A gap in the check is not evidence of a bad deploy, and a step that cries wolf is a step everyone learns to ignore.