ROB-1654 Leave the rollout revision unset until the controller syncs

On a Deployment update the controller hasn't processed yet (e.g.
on_deployment_update right after `kubectl set image`), the revision
annotation and the Progressing condition still describe the previous
template while the images are already the new ones. event.rollout now
reports revision and replicaset as null in that window instead of pairing
them with the wrong images.

The docs' example prompt also lets Holmes answer "unknown" when a
superseded revision's pods are gone and what remains isn't enough to
judge it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NBxJJXuSs1TpB2T7CixgLE

Author: claude

docs/playbook-reference/actions/miscellaneous.rst

@@ -71,7 +71,8 @@ The workflow receives a payload like the one below. ``trigger`` and the ``subjec
 workflow filters (e.g. ``namespace`` = ``payments``). ``description`` says whether the rollout completed or
 failed, and ``resource`` is the Deployment's current manifest (Secret values are always redacted).
 ``rollout`` names the revision that fired: its revision number, the ReplicaSet running it and the image of
-each container. With triggers that set ``change_filters`` (e.g. ``on_deployment_update``), the payload also
+each container. On a Deployment update the controller hasn't processed yet, ``revision`` and ``replicaset``
+are ``null``, because the new revision doesn't exist yet. With triggers that set ``change_filters`` (e.g. ``on_deployment_update``), the payload also
 carries a ``diff`` of the fields those filters kept.
 
 .. code-block:: json
@@ -103,8 +104,10 @@ once it is scaled down. For example:
     A Deployment rollout just completed or failed; the trigger payload names it in `rollout`.
     Judge that revision: the pods of the ReplicaSet in `rollout.replicaset` running the images in
     `rollout.images`. Check that they are running and ready, and look for restarts, warning events
-    and error logs. If the Deployment has since moved to another revision, say so, and still give
-    the verdict for the revision in the payload. End with one line: healthy / degraded / failed.
+    and error logs. If the Deployment has since moved to another revision, say so and judge the
+    revision in the payload from what remains: the ReplicaSet's status and the events of it and
+    its pods. End with one line: healthy / degraded / failed, or unknown if what remains is not
+    enough to tell.
 
 Each cluster's runner triggers the workflow for its own rollouts, so a release rolled out to five clusters
 runs the workflow five times, each against its own cluster. To run it once per release, add the playbook

src/robusta/core/triggers/deployment_rollout_trigger.py

@@ -31,15 +31,22 @@ def get_rollout_revision(deployment: Deployment) -> Dict[str, Any]:
     Old ReplicaSets are kept (revisionHistoryLimit), so the ReplicaSet can still be inspected after the
     Deployment rolls out a newer revision.
     """
-    annotations = (deployment.metadata.annotations if deployment.metadata else None) or {}
-    condition = get_progressing_condition(deployment)
-    match = REPLICASET_IN_MESSAGE.search(condition.message or "") if condition else None
     pod_spec = deployment.spec.template.spec if deployment.spec and deployment.spec.template else None
-    return {
-        "revision": annotations.get(REVISION_ANNOTATION),
-        "replicaset": match.group(1) if match else None,
+    rollout = {
+        "revision": None,
+        "replicaset": None,
         "images": {c.name: c.image for c in pod_spec.containers} if pod_spec else {},
     }
+    # Until the controller syncs a spec change, the revision and ReplicaSet still describe the previous template
+    if not deployment.status or not _is_spec_observed(deployment):
+        return rollout
+
+    annotations = (deployment.metadata.annotations if deployment.metadata else None) or {}
+    condition = get_progressing_condition(deployment)
+    match = REPLICASET_IN_MESSAGE.search(condition.message or "") if condition else None
+    rollout["revision"] = annotations.get(REVISION_ANNOTATION)
+    rollout["replicaset"] = match.group(1) if match else None
+    return rollout
 
 
 def _is_spec_observed(deployment: Deployment) -> bool:

tests/test_workflow_trigger.py

@@ -375,6 +375,8 @@ def test_event_payload_diff_follows_the_triggers_change_filters():
 
     payload = build_event_workflow_payload(event)
     json.dumps(payload)
+    # the controller hasn't synced the new template yet: its revision and ReplicaSet don't exist
+    assert payload["event"]["rollout"] == {"revision": None, "replicaset": None, "images": {"app": "busybox:1.37.0"}}
     assert payload["event"]["diff"] == [
         {
             "path": "spec.template.spec.containers[0].image",