chore: pin all self-refs to full SHAs and update release flow

[derekmisler]

Related Issues

Closes https://github.com/docker/gordon/issues/327

Summary

Replaces all mutable @latest tag references with immutable full-SHA pins across the repo, rewrites the release workflow to maintain SHA-pinned refs going forward, and migrates all workflows from RELEASE_TOKEN to a GitHub App token. Also adds automatic discovery and updating of consumer repos on release.

Changes

SHA-pin all self-references

Every docker/cagent-action*@latest ref is now @dba0ca51... # v1.3.1 — across workflow files (release.yml, review-pr.yml), composite actions (review-pr/action.yml, review-pr/reply/action.yml), and documentation (README.md, review-pr/README.md, security/README.md). The mutable latest tag is no longer created or updated.

Rewrite release pinning logic (release.yml)

• The sed pattern now matches @<40-hex-sha> # v<semver> instead of @latest, and pins to HEAD_SHA (the parent commit on main) rather than a version tag
• Search scope expanded to include release.yml itself and markdown files
• New validation step catches SHA-pinned refs that lack version comments (which would silently skip future auto-updates)

New update-self-refs job (release.yml)

Replaces the old update-pinata job. After tagging a release, opens a PR back to main that updates all SHA refs (in .yml, .yaml, and .md files) to point at the new release commit. Uses separate sed patterns for YAML (uses: anchored) and Markdown (broader match). Stages all changed files via git add -A instead of a single hardcoded path.

New update-consumers job (release.yml)

Dynamically discovers all docker/* repos that reference the cagent-action reusable workflow via GitHub code search, then opens/updates a PR in each one to bump the SHA pin. Gated behind the new pre_release input so test releases can skip consumer updates. Includes permission checks, clone failure handling, and idempotent PR create-or-update logic.

Migrate from RELEASE_TOKEN to GitHub App token

All jobs in release.yml and the renamed update-docker-agent-version.yml now use tibdex/github-app-token with CAGENT_REVIEWER_APP_ID / CAGENT_REVIEWER_APP_PRIVATE_KEY. A new "Validate token permissions" step in the release job fails fast if the token lacks push access. The update-cagent-version.yml → update-docker-agent-version.yml rename also drops the HAS_APP_SECRETS / continue-on-error fallback — the app token is now required.

Other changes

• review-pr.yml: Moved ROOT_COMMENT_ID validation into its own step (earlier in the pipeline, before the authorization check)
• reply-to-feedback.yml / review-pr.yml: Removed "React on failure" steps that added confused emoji reactions
• update-self-refs PR body no longer includes /skip-builds and /skip-tests commands

Test plan

• Trigger a pre_release dispatch and verify:
  • Release commit is created with SHA-pinned refs
  • Tag is pushed, GitHub Release is created
  • update-self-refs PR is opened against main
  • update-consumers job is skipped
• Trigger a normal release and verify update-consumers discovers and PRs consumer repos
• Confirm the latest tag is not created/updated
• Verify update-docker-agent-version.yml works without RELEASE_TOKEN fallback

---

Tip

Comment /review to trigger the PR Reviewer agent for automated feedback.
Comment /describe to generate a PR description.

[docker-agent]

Assessment: 🟢 APPROVE

This PR successfully implements SHA-pinned self-references and updates the release workflow. The changes are well-structured and secure.

What was reviewed:

• ✅ SHA-pinning logic correctly replaces mutable @latest refs with immutable SHA pins
• ✅ Token migration from RELEASE_TOKEN to GitHub App token is properly implemented
• ✅ New update-consumers job safely handles external repo updates with proper error handling
• ✅ Shell variable quoting is correct throughout (double-quoted to prevent injection)
• ✅ Validation logic improvements in review-pr.yml (ROOT_COMMENT_ID validation moved earlier)

Minor observation:
The update-consumers job has a very narrow window where temp directories might not be cleaned up if a signal arrives between clearing the trap (line 326) and manual cleanup. However, this has minimal practical impact since GitHub Actions cleans up runner environments after each run.

Security notes:

• Reviewed for command injection risks - all external inputs (FILE_PATH, REPO) are properly quoted
• GitHub API inputs are constrained by GitHub's own validation
• Error handling appropriately continues on failures without exposing sensitive data

The code is production-ready. Nice work on the comprehensive refactoring! 🚀