claude-botandClaude Opus 5
c3280310b5
Owner directives, both applied here: - "z2m-seed is a shit name for the image — name it for what it is, not for how it is used." Renamed to alpine-jq. Nothing in it is zigbee-specific; it is alpine plus jq, useful to anything that needs to read JSON from a shell script. The Containerfile now describes it that way, with the zigbee2mqtt case recorded as its first consumer rather than its identity. - "You do not need to pin the digest for our own images." Referenced by tag. This also collapses what was going to be two PRs into one, since the digest no longer has to exist before the Deployment can name it. The seed-data init container now uses that image instead of `apk add --no-cache jq` on every pod start. Two consequences of dropping digest pinning, both good: - The whole --image-name-with-digest-file / "PIN THIS:" apparatus is gone from the pipeline. That machinery existed only to hand a digest to a follow-up commit, and it is what broke every pipeline in the repo (#443) via an unquoted ": " in a YAML scalar. Less surface, same outcome. - :latest means Kubernetes defaults imagePullPolicy to Always, so a rebuilt image is picked up without editing the manifest. Kept the fail-loudly validation, since a wrong network_key costs the whole Zigbee network: explicit checks for an absent key (jq prints "null" for a missing path, so that is checked separately rather than being reported as merely "non-hex"), non-hex characters, and a length other than 32. Verified by running the manifest's RENDERED script, against the real coordinator backup and synthetic fixtures. The alpine-jq tag does not exist until this merges and builds, so the run used the existing image of identical content (alpine 3.21.7 + jq 1.7.1, verified present): real backup -> exit 0, network_key line byte-identical to the live value (sha256 27c5c77a945bcecc) non-hex key -> exit 1, "contains non-hex characters" 4-char key -> exit 1, "length 4, expected 32 hex chars" absent network_key -> exit 1, ".network_key.key absent from ..." device link_key also present in the doc -> correctly ignored; the network_key is used Validated with `woodpecker lint` (not just `yq`, which is what let #443 through), plus kustomize build and a server-side dry run. No stale z2m-seed references remain. NOTE: the now-orphaned z2m-seed package is still in the registry and should be deleted; that needs package-delete rights this account does not have. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>