feat: Update default image manifest and Makefile to reflect verified working set

Signed-off-by: Alex Lovell-Troy <alex@lovelltroy.org>

Author: alexlovelltroy

.github/workflows/ci.yml

@@ -23,18 +23,23 @@
 name: ci
 
 on:
+  # Auto-trigger only when an image manifest changes. The harness itself
+  # (scripts, fixtures, compose, tests) doesn't get re-run on every push
+  # because the test surface is the image set — code changes can be
+  # validated with workflow_dispatch when needed.
   push:
     branches: [main]
+    paths:
+      - "images/**.env"
   pull_request:
-  schedule:
-    # Daily 06:00 UTC - drift detection against floating tags
-    - cron: "0 6 * * *"
+    paths:
+      - "images/**.env"
   workflow_dispatch:
     inputs:
       images:
-        description: "Manifest under images/ (release | default | edge | release-v1.0)"
+        description: "Manifest under images/ (default | release | edge | release-v1.0)"
         type: string
-        default: "release"
+        default: "default"
       skip_sim:
         description: "Skip building and starting ipmi-sim / remote-console"
         type: boolean
@@ -93,7 +98,7 @@ permissions:
   packages: read
 
 env:
-  IMAGES: ${{ inputs.images || 'release' }}
+  IMAGES: ${{ inputs.images || 'default' }}
   SKIP_SIM: ${{ inputs.skip_sim || 'true' }}
   SBX_VAULT_IMAGE: ${{ inputs.sbx_vault_image }}
   SBX_LOCALSTACK_IMAGE: ${{ inputs.sbx_localstack_image }}

Makefile

@@ -1,10 +1,11 @@
 .DEFAULT_GOAL := help
 
 ROOT := $(shell pwd)
-# Default to the `release` manifest — each OpenCHAMI service is pinned to its
-# latest GitHub Release tag (regenerate with `make refresh-releases`). Use
-# IMAGES=default for the floating :latest tags, IMAGES=edge for :main builds.
-IMAGES ?= release
+# Default to the `default` manifest — the verified known-good PR-tag mix
+# (see images/default.env header for the date it was last validated).
+# IMAGES=release pins to the latest GitHub Release tags (regenerate with
+# `make refresh-releases`); IMAGES=edge tracks :main for drift detection.
+IMAGES ?= default
 COMPOSE := docker compose -f compose/infra.yaml -f compose/bmc-sim.yaml -f compose/core.yaml
 
 # Export so scripts/load-images.sh sees it.
@@ -15,9 +16,9 @@ export IMAGES
 help: ## Show this help
 	@grep -E '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | awk -F':.*## ' '{printf "  %-20s %s\n", $$1, $$2}'
 	@echo ""
-	@echo "Image selection (default: release — latest GitHub Release tag of each service):"
-	@echo "  make ci                                                  # images/release.env (default)"
-	@echo "  make ci IMAGES=default                                   # images/default.env (floating :latest)"
+	@echo "Image selection (default: default — verified known-good PR-tag mix):"
+	@echo "  make ci                                                  # images/default.env (default)"
+	@echo "  make ci IMAGES=release                                   # images/release.env (latest GH Releases)"
 	@echo "  make ci IMAGES=edge                                      # images/edge.env (:main builds)"
 	@echo "  make ci IMAGES=release-v1.0                              # images/release-v1.0.env (pinned snapshot)"
 	@echo "  make ci SBX_TOKENSMITH_IMAGE=ghcr.io/openchami/tokensmith:pr-23"

images/default.env

@@ -1,16 +1,30 @@
-# integration-sandbox image manifest — default (floating :latest tags)
+# Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
 #
-# NOTE: this is no longer the active default for `make ci`. The active default
-# is now `release` (images/release.env), which pins each OpenCHAMI service to
-# its most recent GitHub Release tag. Use `IMAGES=default` to opt back into
-# the floating :latest tags below.
+# SPDX-License-Identifier: MIT
 #
-# Sourced by the Makefile before invoking docker compose. Per-service env vars
-# (e.g. SBX_TOKENSMITH_IMAGE=ghcr.io/openchami/tokensmith:pr-23) override these.
+# integration-sandbox image manifest — default (verified working set)
 #
-# Switch manifests with `make ci IMAGES=<name>` — looks up images/<name>.env.
+# This is the active default for `make ci` and the CI workflow. The combination
+# below was the only one that produced a green end-to-end run during testing
+# on 2026-05-31; treat it as the canonical "known to work" pin until either:
+#   (a) one of the upstream services publishes a stable release that
+#       supersedes its PR tag AND that release has been verified here, OR
+#   (b) someone explicitly re-verifies against a different combination and
+#       updates this file (bump the date above as part of that change).
+#
+# SMD is on its latest GitHub Release; everything else tracks an in-flight PR.
+# PR tags can be garbage-collected by GHCR — if a pull fails, check the source
+# repo for the live tag.
+#
+# Other manifests:
+#   IMAGES=release      → images/release.env (latest GH Release of each service)
+#   IMAGES=edge         → images/edge.env (:main builds, drift detection)
+#   IMAGES=release-v1.0 → images/release-v1.0.env (pinned snapshot)
+#
+# Per-service env vars (e.g. SBX_TOKENSMITH_IMAGE=...) override entries below.
+# Switch manifests with `make ci IMAGES=<name>` → looks up images/<name>.env.
 
-# Infra (third-party)
+# Infra (third-party, version-pinned)
 SBX_VAULT_IMAGE=hashicorp/vault:1.21
 SBX_LOCALSTACK_IMAGE=localstack/localstack:3
 SBX_POSTGRES_IMAGE=postgres:16-alpine
@@ -19,11 +33,11 @@ SBX_POSTGRES_IMAGE=postgres:16-alpine
 SBX_SUSHY_IMAGE=quay.io/metal3-io/sushy-tools:latest
 SBX_IPMI_SIM_IMAGE=openchami/ipmi-sim:dev
 
-# OpenCHAMI services
-SBX_SMD_IMAGE=ghcr.io/openchami/smd:2.17
-SBX_TOKENSMITH_IMAGE=ghcr.io/openchami/tokensmith:latest
-SBX_BOOT_IMAGE=ghcr.io/openchami/boot-service:latest
-SBX_METADATA_IMAGE=ghcr.io/openchami/metadata-service:latest
-SBX_FRU_IMAGE=ghcr.io/openchami/fru-tracker:latest
-SBX_POWER_IMAGE=ghcr.io/openchami/power-control:latest
-SBX_MAGELLAN_IMAGE=ghcr.io/openchami/magellan:latest
+# OpenCHAMI services — verified known-good combination
+SBX_SMD_IMAGE=ghcr.io/openchami/smd:v2.20.3
+SBX_TOKENSMITH_IMAGE=ghcr.io/openchami/tokensmith:pr-24
+SBX_BOOT_IMAGE=ghcr.io/openchami/boot-service:pr-16
+SBX_METADATA_IMAGE=ghcr.io/openchami/metadata-service:pr-15
+SBX_FRU_IMAGE=ghcr.io/openchami/fru-tracker:pr-22
+SBX_POWER_IMAGE=ghcr.io/openchami/pcs:pr-68
+SBX_MAGELLAN_IMAGE=ghcr.io/openchami/magellan:v0.5.1