Add CI guard to enforce workflow container digest parity with actions-lock pins

[Copilot]

This change adds a mechanical CI check to ensure container images referenced by compiled workflow manifests stay aligned with the digests declared in .github/aw/actions-lock.json. It closes a gap where lock workflows could drift from the canonical container pin source without an explicit failure.

• Scope

  • Adds validate-container-pins job to /home/runner/work/gh-aw/gh-aw/.github/workflows/ci.yml.
  • Runs on CI when workflow lock files or the pins file change.

• Container pin consistency check

  • Parses # gh-aw-manifest from each .github/workflows/*.lock.yml.
  • Compares each manifest container’s digest and pinned_image against .github/aw/actions-lock.json.
  • Fails on missing container entries, digest mismatches, or malformed pinned_image values.

• Trigger coverage

  • Extends CI path filters to include:
    • .github/workflows/*.lock.yml
    • .github/aw/actions-lock.json

expected_digest="$(jq -r --arg image "$image" '.containers[$image].digest // empty' .github/aw/actions-lock.json)"
[ "$digest" = "$expected_digest" ] || fail
[ "$pinned_image" = "${image}@${expected_digest}" ] || fail

[pelikhan]

@copilot revert instructions changes

[Copilot]

@copilot revert instructions changes

Addressed in commit 49ed2de.

[github-actions]

🤖 PR Triage

Field	Value
Category	test/chore
Risk	Low
Priority Score	55/100
Score Breakdown	impact: 28, urgency: 15, quality: 12
Recommended Action	⚡ fast_track
CI Status	⚪ unknown (no checks recorded)

Rationale: Adds a CI guard for container digest parity between workflow manifests and actions-lock pins. Single-file change to . Closes a real drift risk, but low urgency. DRAFT status — needs author to mark ready.

Generated by 🔧 PR Triage Agent · sonnet46 · 36.7 AIC · ⌖ 8.07 AIC · ⊞ 5.7K · ◷

[github-actions]

Hey @Copilot 👋 — thanks for working on this container pin validation! This looks like a focused, well-scoped addition to the CI pipeline. A few observations:

• Draft status — This PR is marked as a draft. When ready for review, move it to "Ready for review" so maintainers can begin assessment.
• Missing test coverage — The new validate-container-pins job adds validation logic but there are no accompanying tests. Consider adding:
  • Unit tests for the shell script logic (happy path: valid pins, error paths: mismatched digests, missing entries)
  • Integration test(s) with sample lock workflows and pins files to verify the job behaves correctly
• Actions checkout pin — The step uses actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd. Verify this hash matches your project's pinned version policy.

Once tests are added and the PR is ready, this should be good to go.

Add test coverage for the validate-container-pins shell script logic in .github/workflows/ci.yml.

Create tests that verify:
1. Happy path: script succeeds when all container pins match
2. Missing entry: script fails when a container is not in actions-lock.json
3. Digest mismatch: script fails when digest doesn't match
4. Pinned image format: script fails when pinned_image is malformed
5. No lock files: script fails with appropriate message when no lock workflows exist

Consider a shell script test utility (e.g. BATS) or integration test approach that mocks the necessary files.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• patchdiff.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "patchdiff.githubusercontent.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · sonnet46 · 61.8 AIC · ⌖ 11.3 AIC · ⊞ 6.2K · ◷

[Copilot]

Pull request overview

Adds CI validation to keep compiled workflow container pins aligned with the canonical actions lock.

Changes:

• Adds lock and pin files to CI path filters.
• Validates manifest digests and pinned image references.
• Reports missing or mismatched container pins.

Show a summary per file

File	Description
.github/workflows/ci.yml	Adds container-pin parity validation and CI path coverage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 4
• Review effort level: Medium

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.83.4