zooqueen 3971ee1e5a Cut a semver and move the pin, instead of a sha nobody points at ...

The build tagged sha-<sha7> and stopped, so every rollout needed a hand-written
pin and the version a human reads was a hash they cannot order or roll back to.
The next patch now comes from the REGISTRY — what is published is the only
authority on what has been used — is proven unused before anything is pushed,
and the run ends by calling universe/charts/app/pin.sh, the one place a deploy
is decided. The image also carries its revision, so it can be traced to a commit.

2026-08-13 23:56:13 -07:00

..

workflows

Cut a semver and move the pin, instead of a sha nobody points at

2026-08-13 23:56:13 -07:00