fix(hermes): recognize containerd release images

services/hermes/scripts/hermes_image_release_status.py

@@ -139,7 +139,12 @@ def _pod_image_status(label: str, repository: str, digest: str) -> tuple[int, in
     for pod in pod_list.get("items", []):
         statuses = list(pod.get("status", {}).get("initContainerStatuses", []))
         statuses.extend(pod.get("status", {}).get("containerStatuses", []))
-        relevant = [item for item in statuses if item.get("image", "").startswith(repository)]
+        relevant = [
+            item
+            for item in statuses
+            if item.get("image", "").startswith(repository)
+            or f"{repository}@" in (item.get("imageID") or "")
+        ]
         if not relevant:
             continue
         if all((item.get("imageID") or "").endswith(f"@{digest}") for item in relevant):

testing/tests/test_hermes_release_followthrough.py

@@ -85,7 +85,9 @@ def _pods(repository: str, digest: str, *, ready: bool = True) -> dict:
                     ],
                     "containerStatuses": [
                         {
-                            "image": f"{repository}@{digest}",
+                            # K3s/containerd can expose only the local image digest
+                            # here while retaining the registry identity in imageID.
+                            "image": "sha256:" + "9" * 64,
                             "imageID": f"{repository}@{digest}",
                         }
                     ],