From c71a184dc1e4747ef836aaca73943a734bc6c0a4 Mon Sep 17 00:00:00 2001 From: Maximiliano Osorio Date: Sat, 29 Aug 2026 20:50:00 -0400 Subject: [PATCH] chore(hasura): pin the image to a commit SHA instead of latest The chart asked for ghcr.io/mintproject/graphql-engine:latest, but the graphql_engine workflow publishes only :main and :. It has never pushed :latest, so that tag is a stale image no merge updates -- it matches none of the last six commits on main, and carries neither the indicator FK migration (mintproject/monorepo#106) nor the cascade migration (mintproject/monorepo#99). pullPolicy: Always cannot help when the tag itself never moves. Pin 06492bd, the merge of mintproject/graphql_engine#15. Migrations are baked into this image, so the tag decides which schema a deployment can reach at all. Same treatment model_catalog_api got in #106. --- charts/mint/Chart.yaml | 2 +- charts/mint/README.md | 4 ++-- charts/mint/values.yaml | 8 ++++++-- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/charts/mint/Chart.yaml b/charts/mint/Chart.yaml index 9e9a49b..b7013b7 100644 --- a/charts/mint/Chart.yaml +++ b/charts/mint/Chart.yaml @@ -15,7 +15,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 9.0.0-beta.4 +version: 9.0.0-beta.5 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. diff --git a/charts/mint/README.md b/charts/mint/README.md index bb78152..1dae825 100644 --- a/charts/mint/README.md +++ b/charts/mint/README.md @@ -1,6 +1,6 @@ # MINT -![Version: 9.0.0-beta.4](https://img.shields.io/badge/Version-9.0.0--beta.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.3](https://img.shields.io/badge/AppVersion-1.16.3-informational?style=flat-square) +![Version: 9.0.0-beta.5](https://img.shields.io/badge/Version-9.0.0--beta.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.3](https://img.shields.io/badge/AppVersion-1.16.3-informational?style=flat-square) A Helm chart for MINT @@ -133,7 +133,7 @@ A Helm chart for MINT | components.hasura.environment.unauthorized_role | string | `"anonymous"` | Unauthorized role for Hasura | | components.hasura.image.pullPolicy | string | `"Always"` | Image pull policy for Hasura | | components.hasura.image.repository | string | `"ghcr.io/mintproject/graphql-engine"` | Docker image repository for Hasura | -| components.hasura.image.tag | string | `"latest"` | Docker image tag for Hasura | +| components.hasura.image.tag | string | `"06492bdedd05ca3534b943739f7ffffe877851da"` | Docker image tag for Hasura. A commit SHA, not `latest`: the graphql_engine workflow publishes only `:main` and `:`, so `:latest` is a stale image it never republishes. Migrations are baked into this image, so the schema a deployment can reach is exactly the one this tag carries. | | components.hasura.ingress.annotations."nginx.ingress.kubernetes.io/enable-cors" | string | `"true"` | | | components.hasura.ingress.className | string | `nil` | | | components.hasura.ingress.enabled | bool | `true` | Enable or disable ingress for Hasura | diff --git a/charts/mint/values.yaml b/charts/mint/values.yaml index 24acb8e..4c2cd71 100644 --- a/charts/mint/values.yaml +++ b/charts/mint/values.yaml @@ -236,8 +236,12 @@ components: image: # -- Docker image repository for Hasura repository: ghcr.io/mintproject/graphql-engine - # -- Docker image tag for Hasura - tag: latest + # -- Docker image tag for Hasura. + # A commit SHA, not `latest`: the graphql_engine workflow publishes only + # `:main` and `:`, so `:latest` is a stale image it never + # republishes. Migrations are baked into this image, so the schema a + # deployment can reach is exactly the one this tag carries. + tag: 06492bdedd05ca3534b943739f7ffffe877851da # -- Image pull policy for Hasura pullPolicy: Always # -- Resource specifications for Hasura