The problem is that it is NOT marked for autosigning, but is expecting to (--write-commitid-to).
We should either tell pungi to update the commitid itself, or make it signed.

So, my assumption was wrong, as Pungi does default to moving the ref.

what is the observed and expected behaviour? and where exactly are you seeing it?

The issue is that the ref in atomic-cd repo is not being updated by composes. E.g. the latest pungi-make-ostree task says:

DEBUG util.py:435:  fedora-atomic/rawhide/x86_64/docker-host => 128452e2c4c73823a9829b0c4f05868da2eecd2b0f70c72d79cab39e61a5e3ae

Yet the ref is still at 9a7fcf05cb413672dede4542b91f3e22d8842020a3087f0edf282cd83bd22d3e, which is months old. This means that anyone using the atomic-cd repo will not be getting the latest commit.

As mentioned above, this is because rpm-ostree is run with --write-commitid-to, which means that the ref is written to a file, rather than to the repo. We need to figure out whether we shouldn't be using that option, or if we should, then determine which task is supposed to do final ref update and why it hasn't been working.

okay, so we will have to look into this, when you say rawhide ostree we assume the one done as part of teh rawhide compose not the continuous delivery ostree. it helps to be very clear about what you are asking, we had looked in a completely different place.

Apologies for the confusion, I amended the original post and title.

there was a bug in pungi, it has been fixed. https://kojipkgs.fedoraproject.org/atomic-cd/refs/heads/fedora-atomic/rawhide/x86_64/ shows being updated today, the other arches will be updated in the next few minutes