Problem
The build-tools image (used as the sysroot-stage init container for ARC/DinD deployments) is not included in the SHA digest pinning infrastructure. When gh-aw compiles a workflow lock file, it cannot supply a digest for build-tools because this repo's image-tag parser rejects the key.
Reported upstream: github/gh-aw#44040
Root Cause
Two gaps in src/image-tag.ts and src/services/sysroot-service.ts:
-
IMAGE_DIGEST_KEYS doesn't include 'build-tools' (src/image-tag.ts:3) — the parser treats build-tools=sha256:... as an invalid key and throws an error.
-
sysroot-service.ts bypasses the pinning helpers — it constructs the image reference directly as `${registry}/build-tools:${tag}` instead of using buildRuntimeImageRef() or assignImageSource(), so even if a digest were available it would never be appended.
Fix
- Add
'build-tools' to the IMAGE_DIGEST_KEYS array in src/image-tag.ts.
- Refactor
buildSysrootStageService() in src/services/sysroot-service.ts to accept a ParsedImageTag and use buildRuntimeImageRef() (or assignImageSource()) so the @sha256:... suffix is appended when a digest is present.
- Update tests in
src/image-tag.test.ts and src/services/sysroot-service.test.ts to cover the new key.
Notes
A corresponding change is needed in github/gh-aw to actually resolve and supply the build-tools digest during lock file generation — see github/gh-aw#44040.
Problem
The
build-toolsimage (used as the sysroot-stage init container for ARC/DinD deployments) is not included in the SHA digest pinning infrastructure. Whengh-awcompiles a workflow lock file, it cannot supply a digest forbuild-toolsbecause this repo's image-tag parser rejects the key.Reported upstream: github/gh-aw#44040
Root Cause
Two gaps in
src/image-tag.tsandsrc/services/sysroot-service.ts:IMAGE_DIGEST_KEYSdoesn't include'build-tools'(src/image-tag.ts:3) — the parser treatsbuild-tools=sha256:...as an invalid key and throws an error.sysroot-service.tsbypasses the pinning helpers — it constructs the image reference directly as`${registry}/build-tools:${tag}`instead of usingbuildRuntimeImageRef()orassignImageSource(), so even if a digest were available it would never be appended.Fix
'build-tools'to theIMAGE_DIGEST_KEYSarray insrc/image-tag.ts.buildSysrootStageService()insrc/services/sysroot-service.tsto accept aParsedImageTagand usebuildRuntimeImageRef()(orassignImageSource()) so the@sha256:...suffix is appended when a digest is present.src/image-tag.test.tsandsrc/services/sysroot-service.test.tsto cover the new key.Notes
A corresponding change is needed in
github/gh-awto actually resolve and supply thebuild-toolsdigest during lock file generation — see github/gh-aw#44040.