fix(container-run.sh): pin the dev/build container image by digest - #11422

Open

basvandijk wants to merge 26 commits into

bas/pin-container-run-image-by-digest

Commits on Sep 2, 2026

fix(ci): pin the dev/build container image by digest in container-run.sh

basvandijk
and
claude
committed
03a1b6e
fix(ci): make the poisoned-tag container-run leg user-independent

basvandijk
and
claude
committed
27834b5
chore(ci): placeholder TAG to exercise the autobuild's digest-pin rewrite

basvandijk
and
claude
committed
1bafba7
revert: chore(ci): placeholder TAG to exercise the autobuild's digest-pin rewrite

basvandijk
and
claude
committed
db30627
fix(ci): address Copilot review of the container-run pin checks

basvandijk
and
claude
committed
a393d8c
feat(ci): make container-run.sh fail closed by default (CONTAINER_RUN_ALLOW_UNPINNED opts out)

basvandijk
and
claude
committed
4ae54a0
fix(ci): drop the unneeded pull-request input of ci-main.yml

basvandijk
and
claude
committed
6f0ba8e
fix(ci): make the docker container-run leg a required check

basvandijk
and
claude
committed
cecd3d9
fix(ci): address Copilot review of the fail-closed default

basvandijk
and
claude
committed
6bd0369
fix(ci): report an empty reference set and fail on a failed tag alias

basvandijk
and
claude
committed
ac5d532
docs(ci): read the digest from ic-dev.digest in the README example

basvandijk
and
claude
committed
9796e51
refactor(ci): drop the redundant post-pull digest recheck in container-run.sh

basvandijk
and
claude
committed
d572eec
chore(ci): drop a redundant comment in container-run.sh

basvandijk
and
claude
committed
ef04a5a

Commits on Sep 3, 2026

remove slop comments
basvandijk
committed
d1ae72c
remove more slop
basvandijk
committed
3a70a67
more compact
basvandijk
committed
6db7f7a
test(ci): refuse a cached mutable-tag image after a failed digest pull

basvandijk
and
claude
committed
957d397
refactor(ci): read the pin files with $(< file) in test-container-run

basvandijk
and
claude
committed
4333718
refactor(ci): name the check_refs parameters in test-container-run

basvandijk
and
claude
committed
dd0ebce
test(ci): cover the edited-inputs branch of container-run.sh

basvandijk
and
claude
committed
6e6599f
ci: gate the test-container-run matrix on a single preflight job

basvandijk
and
claude
committed
5c13458
remove slop
basvandijk
committed
b0c297e
remove more slop
basvandijk
committed
56f3870
wibble
basvandijk
committed
1142530

Commits on Sep 7, 2026