{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=satianurag/ci-digest-guard@0.1.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Finds a GitHub Actions pipeline that builds a Docker image via docker/build-push-action and then deploys it with Terraform using a mutable tag instead of the immutable digest the build step already produced, and fixes it. A push landing between build and deploy -- or a scheduled re-run -- can otherwise deploy a different image than the one that was actually built and tested; a Docker maintainer has confirmed there are no plans to make buildx share images across GitHub Actions jobs another way, which is why pipelines lean on this pattern in the first place. Detects the pattern whether it is CLI (-var=, -var, single or double quotes) or a TF_VAR_image env var, whether build and deploy share one job or are linked by needs:, whether the build step has one tag or a multi-line block of several, and whether the action is pinned by version tag or commit SHA. Every fix is minimal: it adds an id: to the build step, a job-level output exposing steps.<id>.outputs.digest, and rewires only the one line that named the mutab","distribution":{"digest":"sha256:9d4d1889d75d1227e91d665b53a8594fcdf03e343260d251cf5447f4d56dabcc","mediaType":"application/vnd.modiqo.rote-flow","size":27247,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0.json"},"name":"ci-digest-guard","owner":{"kind":"user","slug":"satianurag"},"parameters":[{"description":"Absolute path to the target repository's root. Required outside demo mode: every step in this play runs inside an isolated rote workspace directory, not wherever your terminal happened to be, so there is no current directory to fall back on -- an agent invoking this on someone's behalf already knows its own absolute working directory and should pass it through directly (e.g. repo_path=/Users/you/your-repo, or repo_path=\u0024(pwd) if standing in it). Ignored in demo mode.","example":"/Users/you/your-repo","input":{"allowCustom":true,"choices":[],"label":"Repo path"},"name":"repo_path","required":false,"type":"string"},{"default":".github/workflows","description":"Path to the workflow directory, relative to repo_path. Ignored in demo mode.","example":".github/workflows","input":{"allowCustom":true,"choices":[],"label":"Workflows subdir"},"name":"workflows_subdir","required":false,"type":"string"},{"default":false,"description":"If true, writes every fix to disk on a new branch (ci-digest-guard/pin-image-digest) and opens a PR via gh. If false (default), only reports findings -- fully read-only. Always false in demo mode regardless of what is passed.","example":false,"input":{"allowCustom":true,"choices":[],"label":"Open pr"},"name":"open_pr","required":false,"type":"boolean"},{"default":false,"description":"Run against three bundled fixture workflows instead of your real repository, for a zero-setup first look. Never writes anything and never opens a PR, even if open_pr=true.","example":true,"input":{"allowCustom":true,"choices":[],"label":"Demo"},"name":"demo","required":false,"type":"boolean"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/satianurag/ci-digest-guard@0.1.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.78.0"},"publishedAt":"2026-09-03T19:18:07.655561+00:00","reference":"satianurag/ci-digest-guard@0.1.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3","git","gh"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":2,"installs":0},"steps":{"count":3,"names":["discover","open_pr","scan"]},"title":"ci-digest-guard","type":"play","version":"0.1.0","visibility":"public"}