Repository navigation
Wait for each object's own manifest-id - #106
Merged
Merged
Conversation
manifest-builder now stamps every object with a hash of its own content instead of one deploy-id per generation, and reports the expected id of each changed object. A live object carrying its id holds the content that was written, so detection compares each object against its own id. The deploy-id stays as the name of the change in logs and responses. The diff comment drops both annotations. The old one has to stay until every output has gone through the first generation that swaps it for the new one.
manifest-builder 0.8.0 no longer returns one: each object's manifest-id is what detection waits on, and the output a change went to names it well enough in logs and errors. The deploy_id field goes from the change response and progress events with it.
ps-pufferfish
force-pushed
the
manifest-id
branch
from
September 28, 2026 13:17
8d3beea to
0079b98
Compare
ps-pufferfish
marked this pull request as ready for review
September 28, 2026 13:17
ps-pufferfish
added a commit
that referenced
this pull request
Sep 28, 2026
4.2.4 is gone from Docker Hub, which now publishes 4.3.0 and latest and nothing else non-dev, so the image build for #106 failed resolving the first line of the Dockerfile.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requires manifest-builder 0.8.0 exactly (PortSwigger/manifest-builder#149 and #150), which is published to PyPI and locked here.
manifest-builder 0.8.0 stamps each object with
noa.re/manifest-id, a hash of its own content, and returns the expected id of each changed object inGenerationResult.manifest_ids. It no longer returns a deploy-id. So:wait_for_successtakes a mapping from each created or modified object to its manifest-id, and waits for each object to carry its own id.deploy_idis gone from the change response'soutputsand from thechanged-objectsprogress event. The check that failed detection when manifest-builder returned no deploy-id goes too: relcoord always generates into a git checkout.noa.re/manifest-idlines, and still dropsnoa.re/deploy-idso the migration commit (which swaps one for the other on every manifest) reads as no change. The deploy-id handling can go once every output has been through that commit.Output check: 0.8.0's output was compared with 0.7.14's across all 14 system targets. Apart from
deploy-idbecomingmanifest-idon the same line, the only difference is 23 manifests gaining an annotations block that holds only the manifest-id.Rollout risk: the first generation after this deploys rewrites every manifest in an output. Under the linear
[[rollout]]in system, each stage then waits on every object in its cluster within the 300s detection timeout, and a timeout stops the stages after it. Objects already applied pass on the first check, so this should be fine if Argo syncs promptly. Worth watching on the first change.Validation: all 472 tests pass, as do
ruff check,ruff format --checkandty check, run withuv run --locked --group devaspr-checks.ymldoes.