From b6b37b77b2412e55bb716e73aea980c26f937f27 Mon Sep 17 00:00:00 2001 From: Esteban Gaviria Zambrano Date: Mon, 24 Aug 2026 20:37:14 -0500 Subject: [PATCH] fix(tests): let golden renders tolerate a promoted digest The golden comparison was byte-exact over the whole render, including the image digest. That froze the one field designed to change on every release: every legitimate promotion failed the gate, so the repaired promotion pipeline would still have been blocked, just one step later. The goldens exist to prove COMPOSITION is unchanged across the profile split, not to pin a release. Both sides now normalize @sha256:<64 hex> to a placeholder before comparing, so a promotion no longer has to rewrite them. The gate stays strict everywhere else. Verified by mutation: new digest (legitimate promotion) -> passes replicas 1 -> 3 -> fails namespace changed -> fails digest replaced by a mutable tag -> fails Only the exact digest shape is normalized, so dropping to `latest` is still caught here as well as by the mutable-image job. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01168FA9JzE59y8DbCCn1wMi --- tests/profiles/validate-profile-routing.bats | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/tests/profiles/validate-profile-routing.bats b/tests/profiles/validate-profile-routing.bats index c1bb625..da665e3 100755 --- a/tests/profiles/validate-profile-routing.bats +++ b/tests/profiles/validate-profile-routing.bats @@ -34,11 +34,22 @@ for service in "${services[@]}"; do full_render="$(mktemp)" "$kustomize_bin" build "$economical" > "$economical_render" "$kustomize_bin" build "$full" > "$full_render" - cmp -s "$golden" "$economical_render" || { - diff -u "$golden" "$economical_render" >&2 || true + # The golden renders exist to prove COMPOSITION is unchanged. The image + # digest is the one field designed to change on every release, so pin its + # shape rather than its value: a promotion must not have to rewrite the + # goldens, but dropping to a mutable tag still fails, because only + # @sha256:<64 hex> is normalized. + golden_normalized="$(mktemp)" + render_normalized="$(mktemp)" + sed -E 's/@sha256:[a-f0-9]{64}/@sha256:/g' "$golden" > "$golden_normalized" + sed -E 's/@sha256:[a-f0-9]{64}/@sha256:/g' "$economical_render" > "$render_normalized" + cmp -s "$golden_normalized" "$render_normalized" || { + diff -u "$golden_normalized" "$render_normalized" >&2 || true printf 'FAIL: %s/%s economical render changed.\n' "$service" "$environment" >&2 exit 1 } + unlink "$golden_normalized" + unlink "$render_normalized" grep -Fq 'microtodosuite.io/topology: full' "$full_render" || { printf 'FAIL: %s/%s full render does not select topology-full.\n' "$service" "$environment" >&2 exit 1