Module release_manifest 

The release digest manifest (release-images.yaml).

Schema, parsing, and the shared digest-resolution precedence rule for polychrome upgrade --cluster and the control-plane operator-mailbox originator.

.github/workflows/publish.yml’s channel job writes one release-images.yaml per tagged release (via scripts/make_channel.sh), records it alongside a versioned Kustomize channel under manifests/channels/<tag>/, and attaches it to the GitHub Release as an asset. This module is the reader: fetch downloads and parse_and_validate checks it, and resolve_release_digests implements the one digest-source precedence rule both binaries share — see docs/reference/digest-pinning.md for the operator-facing walkthrough.

Format versioning — refuse, never degrade

The manifest carries format_version so a future breaking schema change is detectable. Polychrome ships zero cross-version compatibility code (the standing no-legacy rule): parse_and_validate refuses any format_version other than FORMAT_VERSION outright rather than attempting a downgrade-safe read. There is no support window — a format bump means updating the CLI before the next cluster upgrade, exactly like every other wire-format change in this repo.

Digest-source precedence

resolve_release_digests resolves each published component’s digest by, per component:

1. If POLYCHROME_UPGRADE_IMAGE_<COMPONENT> overrides the component’s image reference (e.g. a Google Artifact Registry mirror in production), resolve live against that registry — the release manifest genuinely doesn’t describe an image built and pushed to a different registry, so this is a distinct scenario, not a fallback.
2. Otherwise (the default public-GHCR reference), require the release manifest and read the component’s digest from it. A release published before this manifest existed has no asset to read — that is a hard error naming the release, not a silent fallback to a live registry resolve (no-legacy rule: no reader degrades to the old behavior).

A signed --digest set (see crates/cli/src/cmd/upgrade_cluster.rs) sits above both of these — it is pinned verbatim and never reaches this module at all.

Structs

ManifestImage

One published image’s entry in a ReleaseManifest.

ReleaseManifest

The parsed, serde-mapped shape of release-images.yaml.

Enums

ReleaseManifestError

A release-manifest fetch, parse, or validation failure.

Constants

FORMAT_VERSION

The only release-manifest schema version this binary reads. Bump only in lockstep with a scripts/make_channel.sh change that writes the new shape — see the module-level “Format versioning” section.

Functions

fetch

Fetch and validate the release manifest for release_tag (the GitHub tag name, e.g. v2026.8.0) from {base_url}/repos/{owner}/{repo}.

parse_and_validate

Parse release-images.yaml bytes and validate every integrity rule a manifest must satisfy before any of its digests are safe to pin a cluster to.

resolve_release_digests

Resolve every published ghcr::Component’s target digest for version.