Update CLI version checker for Docker image digests - #48043
Merged
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
July 25, 2026 16:39
View session
pelikhan
marked this pull request as ready for review
July 25, 2026 16:43
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the CLI version checker to detect and report Docker image digest changes, including unchanged tags.
Changes:
- Checks and pins digests for all static-analysis images.
- Limits cooldowns to version changes.
- Updates evaluations and generated workflow metadata.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/cli-version-checker.md |
Adds digest checking and reporting instructions. |
.github/workflows/cli-version-checker.lock.yml |
Recompiles workflow metadata and evaluations. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (2)
.github/workflows/cli-version-checker.md:229
- This exemption conflicts with step 2 immediately above, which says a young latest release causes the entire image to be skipped. That prevents the mandatory digest check of the currently pinned tag whenever a newer release is in cooldown. Skip only adoption of the young version and continue checking the current immutable tag;
latestneeds selection of an older stable release that passed cooldown.
This avoids picking up immature or quickly-retracted releases. Digest-only updates for an already-pinned version are not subject to the release cooldown.
.github/workflows/cli-version-checker.md:233
- The mandatory every-image check cannot reliably obtain the registry digest with the examples below. Both registry API examples send literal
Authorization: ******instead ofBearer $TOKEN, causing authenticated manifest requests to fail, while the GHCR Docker path returns a config digest for single-arch images or the first child-platform digest for indexes—not the top-level manifest digest valid for the tag. Use the token in the header and consistently readDocker-Content-Digestfor the requested tag (including OCI index media types).
For every Docker image, fetch the registry digest for the target tag. For a newer version, apply the 3-day cooldown first. Also fetch and compare the digest when the version is unchanged so mutable or republished tags are reflected in `docker_images.go`.
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Medium
| question: Did the agent check for new versions and digest changes of Docker images in pkg/cli/docker_images.go (actionlint, syft, grype, grant, zizmor, poutine, runner-guard, yamllint)? | ||
| - id: updates_applied_or_noop | ||
| question: Were version updates applied and a PR created, or was noop used when all tools were already up to date? | ||
| question: Were version or digest updates applied and a PR created, or was noop used when all tools were already up to date? |
| 1. Check cache-memory at `/tmp/gh-aw/cache-memory/` for previous version checks and help outputs | ||
| 2. If cached versions exist and are recent (< 24h), verify if updates are needed before proceeding | ||
| 3. If no version changes detected, exit early with success | ||
| 3. If no CLI version, Docker image version, or Docker image digest changes are detected, exit early with success |
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CLI version checker now tracks registry digest changes for Docker images used by compile-time static analysis, including changes where the image tag remains unchanged.
Changes
sha256digests.