STAC-25576 add beest verification dispatch - #257
Merged
Conversation
GitLab ran beest_k8s_1_33_containerd_trigger_verification, passing both PROCESS_AGENT_BRANCH_UNDER_TEST and PROCESS_AGENT_HASH_UNDER_TEST. Nothing replaced it on GitHub, so process-agent changes reach beest only when someone dispatches beest by hand and picks the image themselves. Dispatches StackVista/beest pinned to the commit under test. ci.yml tags images with the 8-char short SHA and beest truncates to match, so the full SHA is sent. The pin defaults to this run's SHA only when the branch was not overridden -- against another branch our SHA identifies no image there. Depends on StackVista/beest#63 for the hashes_under_test field, and on pulumi-infra binding BEEST_GH_APP_CLIENT_ID / BEEST_GH_APP_PRIVATE_KEY to this repo; they are bound only to beest today. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
rb3ckers
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitLab ran
beest_k8s_1_33_containerd_trigger_verification, passing bothPROCESS_AGENT_BRANCH_UNDER_TESTandPROCESS_AGENT_HASH_UNDER_TEST. Nothing replaced it on GitHub, so process-agent changes only reach beest if someone dispatches beest by hand and picks the image themselves.This dispatches
StackVista/beestpinned to the commit under test.ci.ymltags images with the 8-char short SHA and beest truncates to match, so the full SHA is sent. The pin defaults to this run's SHA only when the branch was not overridden — against another branch our SHA identifies no image there.Merge order — both are required first:
hashes_under_testfield this dispatches to.BEEST_GH_APP_CLIENT_ID/BEEST_GH_APP_PRIVATE_KEYto this repo (bound only tobeesttoday), and the App needsactions: writeon beest. Without it the token step fails.Validated with actionlint and zizmor (both clean). Deliberately dispatch-only for now rather than automatic on master, so it does not stand up AWS infrastructure on every push.
Ref: STAC-25576