Refresh pinned brave-search container digest in workflow artifacts

[Copilot]

The pinned docker.io/mcp/brave-search image had drifted behind the current tag digest and was carrying critical/high findings from the older manifest. This updates the repository-managed pin to the remediated digest and refreshes the generated workflow artifacts that embed it.

• Pin refresh

  • Update the canonical Brave Search container pin in .github/aw/actions-lock.json
  • Move from:

    "docker.io/mcp/brave-search@sha256:ca96b8acb27d8cf601a8faef86a084602cffa41d8cb18caa1e29ba4d16989d22"

    to:

    "docker.io/mcp/brave-search@sha256:f58a5c22c1196ec7bd1ca586ce216f2334fc298550ddcf652c0e8adb6d256d78"

• Generated pin data sync

  • Regenerate the mirrored container pin data consumed by CLI/workflow code:
    • pkg/actionpins/data/action_pins.json
    • pkg/workflow/data/action_pins.json

• Compiled workflow refresh

  • Recompile the workflows that import the shared Brave MCP config so the new digest is baked into their lockfiles:
    • .github/workflows/brave.lock.yml
    • .github/workflows/mcp-inspector.lock.yml

• Fixture alignment

  • Update the digest-parsing test fixture in pkg/cli/update_container_pins_test.go to reflect the current Brave image manifest digest

• Fixes [container-image-scan] Container findings for ca96b8acb27d #47428

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

[Copilot]

Pull request overview

Refreshes the Brave Search container pin to the digest identified in #47428 and synchronizes generated artifacts.

Changes:

• Updates the canonical and embedded pin data.
• Recompiles affected workflow lockfiles.
• Aligns the digest parsing fixture.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Updates the canonical container pin.
.github/workflows/brave.lock.yml	Refreshes the compiled Brave workflow.
.github/workflows/mcp-inspector.lock.yml	Refreshes the compiled inspector workflow.
pkg/actionpins/data/action_pins.json	Updates embedded action-pin data.
pkg/workflow/data/action_pins.json	Updates workflow pin data.
pkg/cli/update_container_pins_test.go	Aligns the digest fixture.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (only 6 new lines detected).

[github-actions]

❌ Test Quality Sentinel failed to deliver outputs during test quality analysis.

Test Quality Sentinel: Test file modified but contains no new or modified test functions. Only test data (digest values) updated in pkg/cli/update_container_pins_test.go.

[github-actions]

No blocking issues. All 6 files are consistently updated with the new docker.io/mcp/brave-search digest. The old digest (ca96b8ac...) is absent from all tracked files. Non-blocking: the platform sub-manifest SHA (ae3b30d0...) in the test fixture at line 98 was not refreshed; since the test only validates index-level digest extraction this does not affect correctness, but the fixture no longer reflects realistic output for the new image.

🔎 Code quality review by PR Code Quality Reviewer · sonnet46 42 AIC · ⌖ 7.3 AIC · ⊞ 5.7K
_{Comment /review to run again}

[github-actions]

Routine digest pin refresh — old digest (ca96b8ac...) replaced with new digest (f58a5c22c...) consistently across all five changed files (actions-lock.json, both lock YMLs, both action_pins.json copies, and the test). No mixed digests, no stale references, no logic changes. ✅

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 17.4 AIC · ⌖ 7.92 AIC · ⊞ 5K

[github-actions]

Skills-Based Review

Applied /diagnosing-bugs — clean, well-scoped digest pin refresh with no logic changes.

All four pin locations updated consistently and the test fixture kept in sync. No issues found.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 20.6 AIC · ⌖ 4.45 AIC · ⊞ 6.7K
_{Comment /matt to run again}

[github-actions]

🧪 Test Quality Sentinel Report

✅ No test code changes detected.

This PR updates container digest values in test data only. The existing TestBuildxDigestPattern test case was modified to verify against the new digest, but no test functions were added or test logic was changed. Test Quality Sentinel analysis skipped.

Files analyzed: 1 (test data only)
Result: ✅ No action needed

🧪 Test quality analysis by Test Quality Sentinel · haiku45 81.6 AIC · ⌖ 7.7 AIC · ⊞ 7.1K · ◷
_{Comment /review to run again}

[github-actions]

✅ Test Quality Sentinel: No test code changes detected. This PR only updates test data (digest values) within existing test cases. No new tests or modifications to test logic — analysis skipped.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.83.1