Nguyen Minh Phuc b35c551160 ci: the digest-guard test depended on state CI itself mutates ...

The chart job asserted that a bare `helm template` FAILS, on the assumption that
values.yaml always holds all-zeros placeholder digests. That assumption dies the first
time the bump job runs: bump commits real digests into values.yaml, so the bare render
then succeeds and the assertion reports 'the guard is not guarding' about a guard that
is fine. A test whose expected result flips depending on whether CI has run before is
not a test.

Now it feeds the guard four distinct bad digests explicitly with --set — all-zeros,
a bare tag, right-prefix-wrong-length, and empty — and requires each to be rejected.
Verified locally: all four rejected, and a well-formed digest still renders.

2026-07-20 03:48:34 +00:00

..

workflows

ci: the digest-guard test depended on state CI itself mutates

2026-07-20 03:48:34 +00:00