Pin all MCP container images to SHA-256 digests; replace floating tags#25072
Open
Pin all MCP container images to SHA-256 digests; replace floating tags#25072
Conversation
…s with version-pinned images Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8c47ab8e-73e3-41ae-88b7-c835ff933755 Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix containers to use SHA-256 digest pinning
Pin all MCP container images to SHA-256 digests; replace floating tags
Apr 7, 2026
Collaborator
|
This was referenced Apr 7, 2026
…th update/upgrade commands Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b7c65dbf-0da0-4989-a983-3e737df2a9c2 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…x duplicate comment Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b7c65dbf-0da0-4989-a983-3e737df2a9c2 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in commit
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot merge container info in actions-lock.JSON. Update JSON format. |
…rs-lock.json Agent-Logs-Url: https://github.com/github/gh-aw/sessions/47f16cdd-dc8f-4657-8a12-bbc75162a901 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/47f16cdd-dc8f-4657-8a12-bbc75162a901 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in commit Container digests are now stored in the {
"entries": {
"actions/checkout@v4.2.2": { "repo": "...", "sha": "..." },
...
},
"containers": {
"ghcr.io/github/github-mcp-server:v0.32.0": {
"image": "ghcr.io/github/github-mcp-server",
"version": "v0.32.0",
"digest": "sha256:2763823c...",
"source": "ghcr.io"
},
...
}
}
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the MCP workflow supply chain by replacing floating container tags with pinned version tags and optionally appending immutable @sha256: digests sourced from a unified lock file (.github/aw/actions-lock.json).
Changes:
- Introduces container-digest caching alongside action pins in
actions-lock.json, with compiler plumbing to append@sha256:when available. - Pins previously floating base image tags (Node/Python/Alpine) to specific versions and adds a dedicated Playwright MCP Docker version constant.
- Recompiles workflow lock outputs so default image references include digest pins.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/threat_detection.go | Threads shared container cache into image collection for AWF threat-detection steps. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Updates golden output to include digest-pinned image refs. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Updates golden output to include digest-pinned image refs. |
| pkg/workflow/non_github_mcp_guard_policy_test.go | Updates helper signatures to pass optional container cache. |
| pkg/workflow/mcp_setup_generator.go | Builds MCP gateway image refs via digest-aware helper. |
| pkg/workflow/mcp_setup_generator_test.go | Adjusts expectations to use digest-aware helper (cache nil in tests). |
| pkg/workflow/mcp_rendering.go | Passes container cache into renderer options. |
| pkg/workflow/mcp_renderer_types.go | Adds ContainerCache to renderer option structs. |
| pkg/workflow/mcp_renderer_github.go | Uses digest-aware image ref builder for GitHub MCP server refs. |
| pkg/workflow/mcp_renderer_builtin.go | Uses digest-aware refs for Playwright and Alpine images in TOML rendering. |
| pkg/workflow/mcp_config_test.go | Makes assertions tolerant of optional @sha256: suffixes. |
| pkg/workflow/mcp_config_refactor_test.go | Updates expected Alpine image constant and helper signature. |
| pkg/workflow/mcp_config_playwright_renderer.go | Pins Playwright MCP docker image by version and optional digest. |
| pkg/workflow/mcp_config_copilot_test.go | Updates expected default Node image constant (pinned tag). |
| pkg/workflow/mcp_config_compilation_test.go | Updates expected Alpine image constant and digest-tolerant assertions. |
| pkg/workflow/mcp_config_builtin.go | Uses digest-aware Alpine ref in Agentic Workflows MCP JSON rendering. |
| pkg/workflow/docker_predownload_test.go | Updates expected default node image ref to pinned constant. |
| pkg/workflow/docker_api_proxy_test.go | Updates collectDockerImages call signature. |
| pkg/workflow/data/action_pins.json | Adds containers section data alongside action pin entries. |
| pkg/workflow/copilot_github_mcp_test.go | Updates expected GitHub MCP image ref generation. |
| pkg/workflow/copilot_engine_test.go | Updates expected GitHub MCP image ref generation. |
| pkg/workflow/container_cache.go | Adds ContainerCache wrapper over ActionCache for digest lookup/set. |
| pkg/workflow/compiler_types.go | Adds shared container cache to compiler and attaches it to WorkflowData. |
| pkg/workflow/compiler_string_api.go | Injects container cache into WorkflowData for string parsing pathway. |
| pkg/workflow/compiler_orchestrator_workflow.go | Injects container cache into WorkflowData for file parsing pathway. |
| pkg/workflow/codex_mcp.go | Passes container cache into MCP renderer options for Codex engine. |
| pkg/workflow/codex_engine_test.go | Updates expected GitHub MCP image ref generation. |
| pkg/workflow/action_cache.go | Extends lock file model to include containers and writes sorted containers section. |
| pkg/constants/version_constants.go | Adds DefaultPlaywrightMCPDockerVersion. |
| pkg/constants/constants.go | Replaces floating tags with pinned version tags for Node/Python/Alpine defaults. |
| pkg/cli/upgrade_command.go | Runs UpdateContainers() during upgrade to refresh container digests. |
| pkg/cli/update_command.go | Runs UpdateContainers() during update to refresh container digests. |
| pkg/cli/update_containers.go | Adds OCI-registry digest resolution and writes results to actions-lock.json. |
| .github/workflows/typist.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/tidy.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/test-workflow.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/test-dispatcher.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/test-create-pr-error-handling.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/step-name-alignment.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/static-analysis-report.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/sergo.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/schema-feature-coverage.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/schema-consistency-checker.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/safe-output-health.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/repo-tree-map.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/release.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/metrics-collector.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/lockfile-stats.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/instructions-janitor.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/hourly-ci-cleaner.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/go-fan.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/github-remote-mcp-auth-test.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/github-mcp-tools-report.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/github-mcp-structural-analysis.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/firewall.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/example-permissions-warning.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/dev.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/delight.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/deep-report.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/daily-malicious-code-scan.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/craft.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/copilot-session-insights.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/copilot-agent-analysis.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/commit-changes-analyzer.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/cli-version-checker.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/claude-code-user-docs-review.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/ci-doctor.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/changeset.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/bot-detection.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/artifacts-summary.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/ai-moderator.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/workflows/ace-editor.lock.yml | Recompiled workflow output with digest-pinned image refs. |
| .github/aw/actions-lock.json | Adds containers section with digest pins for default images. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 184/217 changed files
- Comments generated: 2
Comment on lines
30
to
36
| // ActionCache manages cached action pin resolutions. | ||
| type ActionCache struct { | ||
| Entries map[string]ActionCacheEntry `json:"entries"` // key: "repo@version" | ||
| path string | ||
| dirty bool // tracks if cache has unsaved changes | ||
| Entries map[string]ActionCacheEntry `json:"entries"` // key: "repo@version" | ||
| Containers map[string]ContainerCacheEntry `json:"containers,omitempty"` // key: "image:version" | ||
| path string | ||
| dirty bool // tracks if cache has unsaved changes | ||
| } |
There was a problem hiding this comment.
Now that ActionCache also persists container digests, Save() can’t treat the cache as “empty” based only on Entries. As written, if Entries is empty but Containers is non-empty (e.g., UpdateContainers in a repo with no existing actions-lock.json entries), Save() will delete/avoid writing the lock file and container digests will be lost. Update Save() to consider both maps (and adjust related logging) so containers-only caches are persisted.
Comment on lines
+261
to
+270
| // fetchRegistryToken retrieves a Bearer token from a Docker-compatible token endpoint. | ||
| // If tokenOverride is non-empty, it is used as the Basic auth credential (for GHCR PAT). | ||
| func fetchRegistryToken(authURL, tokenOverride string) (string, error) { | ||
| req, err := http.NewRequest(http.MethodGet, authURL, nil) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| if tokenOverride != "" { | ||
| req.Header.Set("Authorization", "Bearer "+tokenOverride) | ||
| } |
There was a problem hiding this comment.
The comment says tokenOverride is used as a “Basic auth credential”, but the implementation sets an Authorization: Bearer ... header. Please update the comment to match the actual auth behavior (or adjust the code if Basic auth was intended).
Collaborator
|
@copilot merge main, recompile, review comments |
…-image-digest-pinning # Conflicts: # pkg/workflow/compiler_types.go Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in commit
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges... |
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
❌ Tool validation failed! Agent Container Smoke Test detected missing tools: failed |
Contributor
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... |
Contributor
|
📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident... |
Collaborator
…date golden tests Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f4e311a1-a306-4e94-be00-8654fa8966db Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
The failure was in "Start MCP Gateway" (step 25). The MCP Gateway config schema rejects The code was passing the full digest-pinned ref (e.g. Fixed in commit Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All six MCP stack images were pulled by mutable tag with no digest pinning.
node:lts-alpinewas additionally a floating alias that silently shifts content on each Node.js LTS promotion — a supply-chain attack surface before the agent process even starts.Constants
Floating tags replaced with specific version tags (
pkg/constants/constants.go):node:lts-alpine→node:22-alpinepython:alpine→python:3.12-alpinealpine:latest→alpine:3.21DefaultPlaywrightMCPDockerVersionadded topkg/constants/version_constants.goso the Playwright MCP image gets a pinned version tag (v0.0.68).SHA-256 digests are not hardcoded as Go constants — they live in the lock file instead (see below).
Unified Lock File Format
Container digests are now stored in the
"containers"section of.github/aw/actions-lock.json, alongside the existing"entries"section for GitHub Actions pins. The two sections share a single file and a single load/save lifecycle:{ "entries": { "actions/checkout@v4.2.2": { "repo": "...", "sha": "..." }, ... }, "containers": { "ghcr.io/github/github-mcp-server:v0.32.0": { "image": "ghcr.io/github/github-mcp-server", "version": "v0.32.0", "digest": "sha256:2763823c…", "source": "ghcr.io" }, ... } }containers-lock.jsondoes not exist — there is only one lock file.ActionCachegains aContainers map[string]ContainerCacheEntryfield,GetContainerDigest(), andSetContainer()methods.marshalSorted()writes"entries"first, then"containers".pkg/workflow/container_cache.go—ContainerCacheis a thin wrapper over*ActionCache. It exposes the same digest-lookup and set API but delegates all file I/O to the underlyingActionCache.NewContainerCacheFromActionCache()lets the compiler wrap its already-loaded action cache (zero extra disk reads).Image Reference Construction
buildVersionedImageRef()indocker.goaccepts a*ContainerCacheand appends@sha256:…only when a matching entry exists in the cache. Custom version overrides remain unpinned (digest is unknowable at compile time):The
ContainerCacheis threaded throughWorkflowData,MCPRendererOptions,GitHubMCPDockerOptions, and all renderer functions (collectDockerImages(),MCP_GATEWAY_DOCKER_COMMAND, GitHub MCP JSON/TOML config renderers, Playwright config renderers). Image deduplication incollectDockerImages()uses base-reference keying so that a digest-pinned version always wins over a plain-tag duplicate.Digest Refresh via Update/Upgrade Commands
pkg/cli/update_containers.go—UpdateContainers()resolves fresh SHA-256 digests from OCI registry HTTP APIs (GHCR authenticated withGITHUB_TOKEN, Docker Hub and MCR anonymously) and writes results to the"containers"section ofactions-lock.json.UpdateContainers()is called automatically by bothgh aw updateandgh aw upgradealongside the existingUpdateActions()step, keeping container digests fresh with each update cycle.Compiled Output
All 182
.lock.ymlworkflow files recompiled — every default image reference in generateddownload_docker_images.shinvocations and MCP gateway container config now carries@sha256:.