Image Version → Digest Map¶

This table maps every deployed image version (git SHA / release tag) to its ACR source digest and Harbor tag.

Why this matters: Git SHAs are build identifiers — they tell you which commit built the image. The sha256 digest is the actual image content hash used by skopeo/Harbor. They are different values and must not be confused.

Current Deployed Versions¶

Service	Git SHA / Version	ACR Image	Harbor Tag	sha256 Digest	Mirrored On
core-service	`v3.1.0-rc7` / `b8cf159`	`core-service:staging`	`staging`, `2026-07-01`	`sha256:a3e2aa25578bb279ac3dcec68d69a7406434e57d68cddc9a0da95744e41ec550`	2026-07-01
knowledge-management-service	`98efd55`	`ask-knowledge-management-service:staging`	`staging`, `2026-07-01`	`sha256:fc2911c541a91e3500533a7e0060fd2118f0c2264709ffaf43c7dada1f9080c1`	2026-07-01
assistant-service	`227943514f`	`assistant-service:staging`	`staging`	TBD — run inspect	pending
frontend	`v2.3.3` / `59d882cc`	`frontend-stg:staging`	`staging`	TBD — run inspect	pending

Previous Versions (kept for rollback)¶

Service	Git SHA / Version	Harbor Tag	sha256 Digest	Build Date
core-service	`7240129`	`staging-prev`, `2026-06-17`	`sha256:7240129df2425661ee000db9f02bd3a77eea492e7cc323a3c040a0fe49598549`	2026-06-17
knowledge-management-service	—	`staging-prev`	no digest (old build pre-dating digest pinning)	pre 2026-07-01

How to Get the Digest for a New Build¶

Run on the bastion from ~/harbor-images/:

export https_proxy=http://10.96.137.37:3128

for img in "core-service:staging" "assistant-service:staging" "ask-knowledge-management-service:staging" "frontend-stg:staging"; do
  echo -n "$img: "
  skopeo inspect "docker://ai71uaenprodask71acr01.azurecr.io/$img" \
    --creds "modgpt-devops:$(python3 -c "import json; print(json.load(open('acr-creds.json'))['password'])")" \
    2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin)['Digest'])"
done

Update Workflow (new release)¶

Get git SHA / version from the dev team (e.g. b8cf159 for core-service)
Run the inspect command above to get the real sha256 digest
Update mirror-config.yaml on the Mac:
Demote current staging entry to staging-prev + old date tag
Add new entry with staging + today's date tag + new digest
Update this table
Sync bastion: cd ~/harbor-images && git pull
Run mirror: ./core42-mirror-image.py --only <service>
Update image.tag in mod-ask-devops/applications/<service>/values-mod-auh1-dev-ask.yaml
Commit + push → ArgoCD auto-deploys

ACR Image Name Mapping¶

Service	ACR image name
core-service	`core-service`
assistant-service	`assistant-service`
knowledge-management-service	`ask-knowledge-management-service`
frontend (staging)	`frontend-stg`
frontend (prod)	`frontend-prod`