---
id: w1/m7/t002
title: Immutable operator image (SHA-pin, not :latest)
worker: worker1
status: done
estimate: 30m
depends_on: []
---

## Objective

Stop shipping mutable `:latest` (Argo doesn't roll on code-only changes → manual `rollout restart`). Have CI pin `ghcr.io/stargately/bex-operator:<sha>` into the manifest.

## Context

- CI writes the SHA into `deploy/gitops/base/bex.yaml` (kustomize `images:`), or add Argo Image Updater.
- Root cause of the m3/t001 and m2 rollout gotchas.

## Files

- `.github/workflows/deploy.yml` · `deploy/gitops/base/bex.yaml`

## Acceptance criteria

- [ ] A new operator build updates the pinned SHA in git → Argo rolls the Deployment automatically (no manual restart).

## Out of scope

- Other hardening items.
