From b35c55116016694aa7c36e9b7075a5ec755244a6 Mon Sep 17 00:00:00 2001
From: Nguyen Minh Phuc <son.luong@skylabteam.com>
Date: Mon, 20 Jul 2026 03:48:34 +0000
Subject: [PATCH] ci: the digest-guard test depended on state CI itself mutates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The chart job asserted that a bare `helm template` FAILS, on the assumption that
values.yaml always holds all-zeros placeholder digests. That assumption dies the first
time the bump job runs: bump commits real digests into values.yaml, so the bare render
then succeeds and the assertion reports 'the guard is not guarding' about a guard that
is fine. A test whose expected result flips depending on whether CI has run before is
not a test.

Now it feeds the guard four distinct bad digests explicitly with --set — all-zeros,
a bare tag, right-prefix-wrong-length, and empty — and requires each to be rejected.
Verified locally: all four rejected, and a well-formed digest still renders.
---
 .gitea/workflows/ci.yaml | 36 ++++++++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 91f7170..510cc71 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -255,18 +255,34 @@ jobs:
         run: |
           helm lint deploy/chart
 
-      - name: helm template (rejects unbumped digests)
-        # values.yaml ships all-zeros placeholders, so a bare `helm template` MUST fail.
-        # That is the guard working, not a broken chart — asserting the failure here is
-        # what stops the guard silently regressing into a prefix check again.
+      - name: helm template (the digest guard rejects bad digests)
+        # Feed the guard bad digests explicitly with --set. The earlier version of this
+        # step ran a bare `helm template` and asserted it FAILED, on the assumption that
+        # values.yaml always holds all-zeros placeholders. That assumption dies the first
+        # time the `bump` job runs: bump commits real digests into values.yaml, so the bare
+        # render then succeeds and the assertion reports "the guard is not guarding" about
+        # a guard that is fine. A test whose expected result flips depending on whether CI
+        # has run before is not a test.
+        #
+        # Each case below is a distinct way to get a digest wrong, and each must be
+        # rejected on its own.
         run: |
           set -euo pipefail
-          if helm template svcforge deploy/chart >/dev/null 2>&1; then
-            echo "FAIL: chart rendered against the placeholder digests in values.yaml." >&2
-            echo "The digest guard in _helpers.tpl is not guarding." >&2
-            exit 1
-          fi
-          echo "ok: placeholder digests rejected"
+          ZEROS="sha256:$(printf '0%.0s' $(seq 64))"
+          for bad_desc in \
+            "all-zeros placeholder|${ZEROS}" \
+            "not a digest at all|latest" \
+            "right prefix, wrong length|sha256:abc123" \
+            "empty|"; do
+            desc="${bad_desc%%|*}"; bad="${bad_desc#*|}"
+            if helm template svcforge deploy/chart \
+                 --set image.api.digest="${bad}" >/dev/null 2>&1; then
+              echo "FAIL: the chart rendered with a ${desc} digest (${bad@Q})." >&2
+              echo "The digest guard in _helpers.tpl is not guarding." >&2
+              exit 1
+            fi
+            echo "ok: rejected ${desc}"
+          done
 
       - name: helm template (renders with real digests)
         # Dummy but well-formed digests: this checks the templates themselves render, with