playrote.play.v1

ssatianurag/ci-digest-guardv0.4.0Public

Ci digest guard

Finds a GitHub Actions pipeline that builds a Docker image and then deploys it with Terraform using a mutable tag instead of the immutable digest the build step already produced, and fixes it.

Read the full description

A push landing between build and deploy -- or a scheduled re-run -- can otherwise deploy a different image than the one that was actually built and tested; a Docker maintainer has confirmed there are no plans to make buildx share images across GitHub Actions jobs another way, which is why pipelines lean on this pattern in the first place. Covers two build shapes: docker/build-push-action (any version tag or commit-SHA pin), and a raw `docker build`/`docker buildx build` shell command -- for the raw shape, a plain build prints several different sha256 digests (manifest, config, attestation, manifest list) and grabbing the first one seen would silently pick the wrong one, so the fix adds --metadata-file and reads its containerimage.digest field instead, the same field name the Action uses internally, cross-checked against

  • Published 4 Sep 2026
  • Downloads 2
  • Needs rote 0.62.0+
  • Digest sha256:d699fd53ccdd…
  • Reference satianurag/ci-digest-guard@0.4.0

Before you run it3 local tools

Everything here is checked on your machine when rote inspects the play. This page never learns what you have installed or which credentials you hold.

  • ○
    python3local tool

    Requires >=3.8.0. Run rote play inspect to check your host; unverified versions remain unknown.

  • ○
    gitlocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    ghlocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

Inputs4, all optional

rote asks for these before running and shows the defaults it will use.

  • Repo pathrepo_path

    Absolute path to the target repository's root. Required outside demo mode: every step in this play runs inside an isolated rote workspace directory, not wherever your terminal happened to be, so there is no current directory to fall back on -- an agent invoking this on someone's behalf already knows its own absolute working directory and should pass it through directly (e.g. repo_path=/Users/you/your-repo, or repo_path=$(pwd) if standing in it). Ignored in demo mode.

    optionalstringexample /Users/you/your-repocustom value allowed
  • Workflows subdirworkflows_subdir

    Path to the workflow directory, relative to repo_path. Ignored in demo mode.

    optionalstringdefault .github/workflowsexample .github/workflowscustom value allowed
  • Open propen_pr

    If true, writes every fix to disk on a new branch (ci-digest-guard/pin-image-digest) and opens a PR via gh. If false (default), only reports findings -- fully read-only. Always false in demo mode regardless of what is passed.

    optionalbooleandefault falseexample falsecustom value allowed
  • Demodemo

    Run against three bundled fixture workflows instead of your real repository, for a zero-setup first look. Never writes anything and never opens a PR, even if open_pr=true.

    optionalbooleandefault falseexample truecustom value allowed

What it changes

No write operations are declared in this version's manifest.

Credentials remain in the recipient's local rote vault; this page and the publisher never receive them.

Runtime details
  • rote CLIversion 0.62.0 or newer
  • Servicesnone declared
  • Digestsha256:d699fd53ccddc120ccaeb7cc1d6581573968ec0d9d7135b070ac69bbb745c5ba
  • Archive size36988 bytes
  • Published2026-09-04T04:40:48.7591+00:00
  • Published withrote 0.78.0

Credential values and current readiness remain local. Opening this page never prompts for a credential, opens an authorization browser, or calls a service this play uses.

A play is a published, versioned automation package that runs on your own machine through rote, a free command-line tool. Opening this page installs nothing and runs nothing.