[masih]

The nightly harness reads its three seid images from env values that Flux's image automation writes into platform's harbor CronJob. Getting each bump into git means a bot PR, and main's merge queue won't let the bot merge it, so the tags stop moving. The staleness guard then refuses the run every second day.

With this change, each image input can name a Flux ImagePolicy instead of a tag. When SEID_IMAGE is unset and SEID_IMAGE_POLICY=flux-system/sei-chain-nightly is set (the same goes for _MOCK and _CHAOS), TestMain reads the policy once before any suite starts and uses status.latestRef as name:tag[@digest]. It refuses a policy that is not Ready or whose status was written for an older generation. A literal image still wins, so a bisect or rollback can pin one in git. The staleness regex now also accepts a trailing digest, so the 36h guard still checks the resolved tag and now fires only when the nightly build or the ECR scan has stopped.

The platform change that switches the CronJob to the _POLICY inputs, grants get on the three ImagePolicies and removes the bump automation follows once this image is published.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

PR Summary

Medium Risk
TestMain now requires cluster RBAC/kubeconfig when policy envs are set and fails the whole integration binary if ImagePolicy resolution errors; behavior change is confined to the nightly harness startup path.

Overview
Nightly integration runs can point at Flux ImagePolicy objects instead of committing bumped image tags. TestMain now calls resolveSeidImages (30s timeout) before suites start: when SEID_IMAGE / _MOCK / _CHAOS is unset and the matching *_POLICY=namespace/name is set, the harness reads the policy’s status.latestRef into name:tag[@digest], rejects non-Ready or stale-generation status, and leaves any literal image env override untouched for bisect/rollback.

The existing 36h staleness guard still runs on the resolved values; nightlyTagDate now accepts an optional @sha256:… suffix, and failure text shifts from “stuck bump PR” to nightly publish + Flux scan checks. Chaos tests reuse a shared newDynamicClient helper instead of duplicating kubeconfig wiring.

Unit tests add TestResolveSeidImages (fake dynamic client) and a digest-pinned stale-image case under TestStaleSeidImages.

^{Reviewed by Cursor Bugbot for commit f85baa2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

Lets each nightly seid image input name a Flux ImagePolicy through a _POLICY companion. TestMain resolves it once before any suite starts, refuses a stale or not-Ready status, and the staleness regex now accepts a trailing digest. Checked against the PR merge tree (b54dfe5): the error, generation and condition handling are correct, a literal image still wins, and no client is built unless a policy is named, so nothing blocks; codex's empty reading agrees, so there was nothing from it to keep or drop. The new tests were not run because the sandbox has no Go toolchain.

_{seidroid review · decision approve · session 8de390ff4cb74b1f97c7f394558a4f2a · turn resp_claude_7ec2865d79a3682e228a389988f6e343 · item 1ec8558d70915536a39f5aa3ffbd9b0d}

Findings: 0 blocking | 0 non-blocking | 0 posted inline