kevinveenbirkenbachandClaude Opus 5 be6a25517c feat(docker): classify image pins and build pull references from the class ...

A digest pin was emitted as `name:sha256:...`, which no registry accepts:
image_source('ghcr.io/.../csp-checker', 'sha256:d559...') returned
'ghcr.io/.../csp-checker:3.0.0'. The separator depends on the pin class, so
the class has to be decided before the reference is built.

utils/docker/image/pin.py names the three classes in preference order
(semver, then digest, then a general ref that no registry can order) and
maps each to the nocheck marker that declares it. Both discovery entry
points now end in pull_reference(), so '@' versus ':' is decided in one
place instead of at every call site.

The semver pin lint points a digest at 'docker-digest' instead of
'docker-version', so the two fallbacks stay distinguishable in the
suppression catalog. It stays warn-only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-17 16:39:16 +02:00

..

cli

style(inventory): wrap the keycloak users fixture the way autoformat does

2026-09-14 20:50:27 +02:00

group_vars

fix(litellm): publish a backend only when the gateway's own flag enables it

2026-09-15 02:06:38 +02:00

library

…

plugins

fix(mirror): keep the origin prefix when an upstream redirects

2026-09-17 12:21:41 +02:00

roles

fix(hlth-csp): let a declared status reach the vhost's onion twin

2026-09-16 23:28:02 +02:00

scripts

fix(diagnostics): let the in-zone probes read the drop-in that holds the zone

2026-09-03 12:50:58 +02:00

utils

feat(docker): classify image pins and build pull references from the class

2026-09-17 16:39:16 +02:00

__init__.py

…