What
The PR-triggered Ghost workflow records the pull request SHA but receives an empty candidate digest and runs ghcr.io/projectbluefin/bluefin:testing. It therefore validates the current testing image, not the submitted PR.
Impact
Systemd and migration changes cannot receive truthful real-boot evidence before merge. For projectbluefin/common#921, CI built the candidate only as localhost/common:<merge-SHA> and did not publish an image that Ghost can boot.
Fix
Publish a scoped, temporary PR candidate image (or have the Ghost workflow build the PR SHA before provisioning) and require the workflow to fail when the candidate image reference/digest is absent. Surface the resolved candidate digest in workflow evidence.
Evidence
What
The PR-triggered Ghost workflow records the pull request SHA but receives an empty candidate digest and runs
ghcr.io/projectbluefin/bluefin:testing. It therefore validates the current testing image, not the submitted PR.Impact
Systemd and migration changes cannot receive truthful real-boot evidence before merge. For projectbluefin/common#921, CI built the candidate only as
localhost/common:<merge-SHA>and did not publish an image that Ghost can boot.Fix
Publish a scoped, temporary PR candidate image (or have the Ghost workflow build the PR SHA before provisioning) and require the workflow to fail when the candidate image reference/digest is absent. Surface the resolved candidate digest in workflow evidence.
Evidence
common-921-fix-systemd-remove-rechunker-l-8gmd6