CI build provenance
Attach a source commit to the exact image produced by your pipeline.
Self-hosted alpha.18 accepts a per-service provenance map in plan and deployment requests. Your pipeline can keep building images while Hakopod records the commit, repository and run behind each submitted image.
Report the build you actually ran#
Each service entry must contain the exact digest-pinned image reference from its specification, the full source commit ID, provider and repository. A run URL and branch are optional. Get the commit from the checkout actually used to build the image, especially when a pipeline uses another repository or a remote build context.
Include provenance in both the reviewed plan and deployment. It is recorded atomically with the immutable release and included in the idempotency hash. Changing metadata while reusing a request key returns a conflict.
Read a claim as a claim#
External records are marked ci_reported. They are authenticated pipeline assertions, not independently verified attestations. Hakopod does not verify registry signatures or fetch the workflow URL. Conflicting claims become ambiguous rather than choosing an authoritative commit.
A record proves which metadata was accepted. It does not prove that every pod is ready or that a bug is fixed. Check deployment success, runtime image IDs and the application behavior separately. Unknown older images are not silently backfilled.
Use the complete versioned CI example, alongside the deployment guide.