fix(panel): allow Update for bots on sha-* image pins

- Treat bots running same-repo `sha-*` or digest pins as eligible to Update onto the configured channel's target, enabling bots pinned at creation time to leave the pin via Update
- Clarify that only the *bot's* image needs to be a pin to be eligible; when `STITCH_PANEL_BOT_IMAGE` itself is a pin, bots on the resolved `:latest` target remain eligible for later releases
- Update error message to reflect that Update works for same-repo sha-* / digest pins moving to the resolved target
- Add tests verifying sha-pinned bots can Update when panel targets `:latest`, and bots on old pins can Update when panel advances to new pins

Author: bnolens

.textile-monorepo-source

@@ -1 +1 @@
-24d3dc31eb7189aa778aebb81a5174c8f58e0bc2
+91134999768b376b01ab7022be8a43ba029dad41

.textile-stitch-release-version

@@ -1 +1 @@
-0.1.120
+0.1.121

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "stitch-bot"
-version = "0.1.120"
+version = "0.1.121"
 edition = "2021"
 description = "Stitch — Textile filler-network operator bot; market-makes the filler order book with signed UniswapX limit orders."
 license = "AGPL-3.0-or-later"

Cargo.toml

@@ -872,8 +872,9 @@ async fn recreate_on_image(
             ) {
                 return Err(ApiError::conflict(format!(
                     "{name} runs {current}, which is not on the update channel for {}. Update \
-                     only refreshes bots already on STITCH_PANEL_BOT_IMAGE (sha-* pins may \
-                     move to :latest) — recreate it from your own compose file, or change \
+                     only refreshes bots on STITCH_PANEL_BOT_IMAGE's repository and tag \
+                     channel (same-repo sha-* / digest pins may move to the resolved \
+                     target) — recreate it from your own compose file, or change \
                      STITCH_PANEL_BOT_IMAGE.",
                     state.cfg.bot_image
                 )));
@@ -2866,6 +2867,65 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn update_allows_a_sha_pinned_bot_when_the_panel_targets_latest() {
+        // Production often pins bots at create time while STITCH_PANEL_BOT_IMAGE
+        // is `:latest` (or later moves there). Those bots must still be able to
+        // leave the pin via Update — not get a channel-gate conflict.
+        let h = super::super::testkit::harness_with_bot_image(
+            "bot-update-sha-on-latest",
+            "ghcr.io/textile-protocol/textile-stitch:latest",
+        );
+        seed_panel_bot(&h, "bot-a");
+        h.docker.set_container_image(
+            "stitch-bot-a",
+            "ghcr.io/textile-protocol/textile-stitch:sha-oldc0de",
+        );
+
+        let (status, body) = h
+            .post_json("/api/bots/bot-a/update", serde_json::json!({}))
+            .await;
+        assert_eq!(status, StatusCode::OK, "{body}");
+        let expected = "ghcr.io/textile-protocol/textile-stitch:latest";
+        assert!(
+            h.docker.calls().iter().any(|c| matches!(
+                c,
+                Call::EnsureImage { image, refresh: true } if image == expected
+            )),
+            "sha-pinned bot must Update onto the panel's :latest channel, got {:?}",
+            h.docker.calls()
+        );
+    }
+
+    #[tokio::test]
+    async fn update_allows_a_bot_on_a_different_sha_pin_than_the_panel() {
+        // Panel env advanced to a new sha-* pin; existing bots still run the old
+        // one. Update resolves pins to :latest, so they must not be stuck.
+        let h = super::super::testkit::harness_with_bot_image(
+            "bot-update-other-sha",
+            "ghcr.io/textile-protocol/textile-stitch:sha-newpin00",
+        );
+        seed_panel_bot(&h, "bot-a");
+        h.docker.set_container_image(
+            "stitch-bot-a",
+            "ghcr.io/textile-protocol/textile-stitch:sha-oldpin00",
+        );
+
+        let (status, body) = h
+            .post_json("/api/bots/bot-a/update", serde_json::json!({}))
+            .await;
+        assert_eq!(status, StatusCode::OK, "{body}");
+        assert!(
+            h.docker.calls().iter().any(|c| matches!(
+                c,
+                Call::EnsureImage { image, refresh: true }
+                    if image == "ghcr.io/textile-protocol/textile-stitch:latest"
+            )),
+            "old sha pin must still Update to :latest, got {:?}",
+            h.docker.calls()
+        );
+    }
+
     #[tokio::test]
     async fn update_refuses_when_the_fresh_pull_fails() {
         // Same contract as panel self-update: a pull failure must not destroy the

src/panel/http/bots.rs

@@ -91,34 +91,34 @@ pub fn same_image_repository(a: &str, b: &str) -> bool {
 /// Whether a running bot image is on `STITCH_PANEL_BOT_IMAGE`'s update channel.
 ///
 /// Same repository is not enough: a bot on `:canary` must not be Updated onto
-/// `:latest` just because they share a repo. Mutable tags must match. An
-/// explicit `sha-*` / digest pin may Update onto the resolved `:latest` target,
-/// and bots already on that resolved target stay eligible for later releases
+/// `:latest` just because they share a repo. Mutable tags must match.
+///
+/// An explicit `sha-*` / digest pin on the *bot* may always Update onto the
+/// configured channel's target — operators pin for reproducibility, then use
+/// Update to leave the pin. When the *configured* image is itself a pin, bots
+/// already on the resolved `:latest` target stay eligible for later releases
 /// (otherwise a successful pin→latest Update would leave them "off channel"
 /// forever while the env still names the pin).
 pub fn bot_eligible_for_configured_update(current: &str, configured: &str) -> bool {
     if !same_image_repository(current, configured) {
         return false;
     }
     let cur = parse_image_ref(current);
+    // Any same-repo sha-* / digest pin can leave the pin via Update, whether
+    // STITCH_PANEL_BOT_IMAGE is `:latest`, another pin, or a mutable channel.
+    if cur.tag.starts_with("sha-") || current.contains('@') {
+        return true;
+    }
     let cfg = parse_image_ref(configured);
     let cfg_is_pin = cfg.tag.starts_with("sha-") || configured.contains('@');
     if cfg_is_pin {
-        let on_pin = if configured.contains('@') {
-            current == configured
-        } else {
-            cur.tag == cfg.tag
-        };
-        if on_pin {
-            return true;
-        }
         // Already moved to the resolved update target (:latest). Exact ref only —
-        // digest refs parse with a synthetic `latest` tag, so tag equality would
-        // treat any same-repo `@sha256:…` as on-channel.
+        // digest refs are handled above as pins (a synthetic `latest` tag would
+        // otherwise treat any same-repo `@sha256:…` as on-channel).
         return update_target_image(configured).is_some_and(|target| current == target);
     }
-    // Mutable channel: already on that tag (not a digest-only ref of another build).
-    !current.contains('@') && cur.tag == cfg.tag
+    // Mutable channel: already on that tag.
+    cur.tag == cfg.tag
 }
 
 /// True when `remote` (a `sha256:…` digest) is not among the local RepoDigests.
@@ -481,6 +481,7 @@ mod tests {
         let latest = "ghcr.io/textile-protocol/textile-stitch:latest";
         let canary = "ghcr.io/textile-protocol/textile-stitch:canary";
         let pin = "ghcr.io/textile-protocol/textile-stitch:sha-deadbeef";
+        let other_pin = "ghcr.io/textile-protocol/textile-stitch:sha-cafebabe";
         let digest_pin = "ghcr.io/textile-protocol/textile-stitch@sha256:aaaa";
         assert!(bot_eligible_for_configured_update(latest, latest));
         assert!(!bot_eligible_for_configured_update(canary, latest));
@@ -492,14 +493,19 @@ mod tests {
             "ghcr.io/acme/stitch-fork:v9",
             latest
         ));
-        // A different digest must not look "already on :latest" via synthetic tags.
-        assert!(!bot_eligible_for_configured_update(
+        // Bots still on a sha-* / digest pin must be able to Update onto the
+        // panel's mutable channel (the common "panel is :latest, bot is sha-…"
+        // case) — and onto :latest when the env itself still names a pin.
+        assert!(bot_eligible_for_configured_update(pin, latest));
+        assert!(bot_eligible_for_configured_update(digest_pin, latest));
+        assert!(bot_eligible_for_configured_update(other_pin, pin));
+        assert!(bot_eligible_for_configured_update(
             "ghcr.io/textile-protocol/textile-stitch@sha256:other",
             pin
         ));
         assert!(bot_eligible_for_configured_update(digest_pin, digest_pin));
         assert!(bot_eligible_for_configured_update(latest, digest_pin));
-        assert!(!bot_eligible_for_configured_update(
+        assert!(bot_eligible_for_configured_update(
             "ghcr.io/textile-protocol/textile-stitch@sha256:bbbb",
             digest_pin
         ));