- Shipped
- September 9, 2026 at 3:18 AM UTC
- Author
- Kamo
- Commit
- afb3fec
Both protections against a deploy that deploys nothing were inert, so the pipeline reported two green jobs while the pods stayed on the previous digest. That is how billingservice ran for a day on a kamo-shared-library too old to name ServiceType 35, 500ing the entire plan catalog for every organization while every signal said the deploy had succeeded. The reference comparison could not work. "Apply manifests" runs kubectl apply on k8s/deployment.yaml, whose image is :latest, so `before` was always :latest and `after` always the SHA. They differ on EVERY run, including the same-commit rebuild the check exists for, so the forced restart never fired — Kubernetes matched the pre-existing SHA ReplicaSet, kept the old pods, and rollout status returned instantly. The digest assertion that should have caught that sent no credentials to the registry, so Docker-Content-Digest came back empty and the step took its deliberate fail-open branch: "skipped digest verification", exit 0. Decide the restart on the digest instead, carried down from the build job, which is the only thing that can tell a fresh image from a stale one when the tag is unchanged. Same fix securityservice took in 6852acb. The digest output is MERGED into the outputs block that was already there — a second `outputs:` mapping key makes Forgejo skip the workflow entirely, with no run and no error.