gh-aw-firewall build-tools image emits only the tag in v0.82.3 lock files (mising SHA pinning)

[mikeparker-msft]

Potentially related to #43307 and #38561. Looks like one image in the same family got missed: ghcr.io/github/gh-aw-firewall/build-tools:0.27.26.

Compiling a workflow with runner.topology: arc-dind pulls in a fifth firewall image, build-tools (the ARC/DinD sysroot init container), alongside the four covered by #43307 and #38561. On gh aw v0.82.3, agent, api-proxy, cli-proxy, and squid are all correctly SHA-pinned now — but `build-tools isn't.

Expected — every gh-aw-firewall/* image carries a digest/pinned_image:

{"image":"ghcr.io/github/gh-aw-firewall/build-tools:0.27.26","digest":"sha256:...","pinned_image":"ghcr.io/github/gh-aw-firewall/build-tools:0.27.26@sha256:..."}

Actual — build-tools is emitted tag-only, no digest:

  {"image":"ghcr.io/github/gh-aw-firewall/build-tools:0.27.26"}

Environment

• gh aw v0.82.3 (installed via gh extension install github/gh-aw --pin v0.82.3)
• macOS local compile (gh auth)
• Firewall image tag 0.27.26, mcpg v0.3.33 — fetched pins should be current

Workaround

As was the case for 43307 and #38561, manually patching digests into the lock file works but doesn't survive gh aw compile.

[lpcox]

gh-aw side fix needed

The firewall side (gh-aw-firewall) needs to add build-tools to IMAGE_DIGEST_KEYS and wire the sysroot service through the pinning helpers — I've filed that separately.

On the gh-aw side, the lock file generator needs to resolve and emit the digest for build-tools the same way it already does for squid, agent, api-proxy, and cli-proxy. Specifically, whatever code builds the --image-tag value (the comma-separated tag,key=sha256:... string) needs to:

1. Query GHCR for the build-tools manifest digest (same as it does for the other four images).
2. Append build-tools=sha256:<digest> to the image-tag string emitted into lock files.

Once both sides land, build-tools will be pinned like the other images.