Skip to content

test(release): verify published artifacts on fresh installs and upgrades #877

New issue
New issue
Open
#906
Open
test(release): verify published artifacts on fresh installs and upgrades#877
#906
Labels
area: chartHelm chart and deploymentarea: e2ekind-based end-to-end suitetype: ciCI, workflows, or build tooling

Description

@Baylem
Baylem
opened on Nov 11, 2026

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

The v0.4.0 run failed the web scan, then skipped chart publication and GitHub release. Individual image tags can exist before a complete chart/image set is available. The web package update is already under review in PR #866.

Work

Use the existing web fix and the normal immutable release process to qualify a complete release. Extend or reuse the published-upgrade harness from PR #863 to consume the actual candidate artifacts. Record the chart and required image digests, signatures/provenance and target release version. Preserve the original release tag and keep the workflow’s existing signing/verification steps.

Acceptance criteria

From a fresh consumer identity, pull and verify the actual chart and every required image at the documented registry path. Exercise clean install and upgrade from the preceding supported published chart against populated PVCs, check runtime image IDs and retained data, and link the successful release run and evidence.

PR ownership and prior work

Release verification can proceed as soon as a corrected candidate exists. Other audit work uses its qualification job for later releases. Leave package remediation to #866. Publication was skipped in the tag run.

Release job · Skipped chart job

Activity

  1. Baylem
    added
    type: ciCI, workflows, or build tooling
    area: chartHelm chart and deployment
    area: e2ekind-based end-to-end suite
    on Nov 11, 2026
  2. Baylem
    added a parent issue on Nov 11, 2026
  3. Baylem
    changed the title [-][High H10] Qualify publication, install and upgrade of the release following the failed v0.4.0 run[/-] [+]test(release): verify published artifacts on fresh installs and upgrades[/+] on Nov 11, 2026
  4. Baylem
    linked a pull request that will close this issuetest(release): qualify signed published artifacts on clean installs and upgrades #906on Nov 11, 2026

  5. Baylem commented on Nov 11, 2026

    @Baylem
    Baylem
    on Nov 11, 2026
    MemberAuthor

    The consumer in #906 now checks the amd64 and arm64 image configurations against the peeled Git commit and release version for every component in the tagged publisher’s matrix. A previously signed image moved to a new tag must fail. The clean-install and populated-upgrade fixtures use a private kubeconfig and randomly named clusters, and clean up only the node identities they created. Commit

    Anonymous reads of the historical v0.3.0 release verified the chart signature, all 12 image signatures and both Linux configurations for every image against commit 040e10ee16253f6ead593bd076ed90835b68e2c1. The historical registry is ghcr.io/valgulnecron. Helm resolved charts/gameplane@sha256:59f107bc2935c3c194d93fc5fa1e41c42a68419250e0778d68c8083cc52fccf8 to chart and app version 0.3.0. The API and web signed indexes were sha256:ccbe29755dd72fe191f97f0a3bc36e13bd672d6578e659272c9cb0be64198ae3 and sha256:f67a34ec96a17dfaa26d8323a9abdf5b080273a5911448ed519db2dc9a7bbc29. Published v0.3.0

    Before publication, v0.4.0 pointed to 07bee47bf01a7ced0114898605155499065dfb26. The web image returned HTTP 404. The signed API index at that commit was sha256:774229ab7f2d9ecdd0d43a742cd833124c299780b4623308208d87d4b3586f59. Original failed tag run

    After #866 merged, upstream moved the v0.4.0 tag to 46b719f6da280ba5f1b42a6aa21ef2d2db35d683 and published the release at 15:48 UTC on November 11. GitHub marks the published release immutable. Moving the pre-publication tag is a recorded exception to the original tag-preservation request. Both source commits and publisher runs remain independently identifiable. The read-only consumer was dispatched against the corrected artifacts from #906 at 1504f079. Successful publisher · Published release · Consumer run

    Commit 1504f079 also matches the repository name and digest in each signed payload. The registry check verified those claims for all 12 historical indexes, the historical chart, and the 11 published v0.4.0 image indexes. During the populated upgrade, the consumer installs the predecessor chart by its verified digest and checks the running API, operator and agent against their signed historical image IDs before upgrading. Follow-up commit · Current CI

    Published v0.4.0 consumer passed. An anonymous consumer verified the signed chart ghcr.io/gameplanepanel/charts/gameplane@sha256:fda83c36ce540b81e3c9641037e542ab8e6ac9270fe560396e34c9300bcaf12c, all 12 published component indexes, and 24 linux/amd64 and linux/arm64 configurations against 46b719f6. Fresh amd64 installation and upgrade from the signed v0.3.0 release both succeeded. The running API, operator and web image IDs matched the signed indexes. The upgraded game agent matched its signed index too. The populated upgrade took 29.55 seconds and verified the same game data PVC UID, original world marker and pre-existing user login. The test compares the UID directly and prints it only on failure. Consumer job and digests · Retention assertions

    The observed v0.4.0 indexes were API sha256:654c6dc5f3101c1c5b60e176b78b4e07956b0dc8be6933b2a221bd4a8e791cb7, operator sha256:fab7b16c0351f45a925c7abc7a5efa3a3b3cdac8136cdced8d0286a001269a4a, web sha256:c401e07a6cd93b074e4b8bf4694e5906b6a71a51beb825f66fc15d6db4ba79b8, and agent sha256:f6e69e0cc2d45114bfecf9c9a8e1b50ac87fd31c196ebb1ef6180cfb8bcf1646. The published release is immutable. The pre-publication tag move described above remains part of the release history.

    The release-only dispatch on the restacked #906 commit 685603d0d0398f12927636194e06f60595a4bf80 passed with one runnable job and 36 ordinary jobs skipped. The populated v0.3.0 to v0.4.0 upgrade took 34.73 seconds. Fresh installation and upgrade both matched the signed runtime image IDs above. The upgrade also confirmed the same PVC UID, seeded world file and pre-upgrade login. Release-only consumer and runtime digest transcript

    After the final screenshot workflow from #917 entered the integration base, the release patch remained identical. On 48887be2, the anonymous v0.4.0 consumer passed again with one executed job and 36 expected skips. The populated v0.3.0 upgrade took 39.92 seconds and confirmed the same PVC UID, world marker, prior user login and signed image IDs. Final release qualification and runtime digests · Final ordinary PR checks

  6. Baylem commented on Nov 12, 2026

    @Baylem
    Baylem
    on Nov 12, 2026
    MemberAuthor

    #906 passed release qualification on ddba490b85d2d6585aa62989ac8fbf379c97b45a. The anonymous consumer verified the published v0.4.0 chart and images, completed a fresh Kind install, and upgraded a populated v0.3.0 installation in 31.74 seconds. The game kept its original PVC UID and world marker, the pre-upgrade user could still log in, and the running components matched the signed image digests. Release job with runtime image IDs

    The ordinary PR matrix finished with 110 successful jobs and one expected skip. The populated Kind upgrade also passed on amd64 and arm64. Full CI report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: chartHelm chart and deploymentarea: e2ekind-based end-to-end suitetype: ciCI, workflows, or build tooling

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions