- Shipped
- September 13, 2026 at 7:58 PM UTC
- Author
- Kamo
- Commit
- 26c92b3
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already applied k8s/deployment.yaml (image :latest), so the reference always changed, the restart never fired, and the pod template ended up identical to the running ReplicaSet: no pods rolled. The digest check then fetched the manifest without credentials, got a 401, and skipped verification, so the job passed while the old code kept running. Resolve the built digest from the registry with REGISTRY_USER/REGISTRY_TOKEN (xtrace suppressed around the call). If the running pods are not on that digest, rollout restart, wait for it, and re-check; fail the job if they are still not on it.