{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=satianurag/ci-digest-guard@0.4.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Finds a GitHub Actions pipeline that builds a Docker image and then deploys it with Terraform using a mutable tag instead of the immutable digest the build step already produced, and fixes it. A push landing between build and deploy -- or a scheduled re-run -- can otherwise deploy a different image than the one that was actually built and tested; a Docker maintainer has confirmed there are no plans to make buildx share images across GitHub Actions jobs another way, which is why pipelines lean on this pattern in the first place. Covers two build shapes: docker/build-push-action (any version tag or commit-SHA pin), and a raw \u0060docker build\u0060/\u0060docker buildx build\u0060 shell command -- for the raw shape, a plain build prints several different sha256 digests (manifest, config, attestation, manifest list) and grabbing the first one seen would silently pick the wrong one, so the fix adds --metadata-file and reads its containerimage.digest field instead, the same field name the Action uses internally, cross-checked against","distribution":{"digest":"sha256:d699fd53ccddc120ccaeb7cc1d6581573968ec0d9d7135b070ac69bbb745c5ba","mediaType":"application/vnd.modiqo.rote-flow","size":36988,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0.json"},"name":"ci-digest-guard","owner":{"kind":"user","slug":"satianurag"},"parameters":[{"description":"Absolute path to the target repository's root. Required outside demo mode: every step in this play runs inside an isolated rote workspace directory, not wherever your terminal happened to be, so there is no current directory to fall back on -- an agent invoking this on someone's behalf already knows its own absolute working directory and should pass it through directly (e.g. repo_path=/Users/you/your-repo, or repo_path=\u0024(pwd) if standing in it). Ignored in demo mode.","example":"/Users/you/your-repo","input":{"allowCustom":true,"choices":[],"label":"Repo path"},"name":"repo_path","required":false,"type":"string"},{"default":".github/workflows","description":"Path to the workflow directory, relative to repo_path. Ignored in demo mode.","example":".github/workflows","input":{"allowCustom":true,"choices":[],"label":"Workflows subdir"},"name":"workflows_subdir","required":false,"type":"string"},{"default":false,"description":"If true, writes every fix to disk on a new branch (ci-digest-guard/pin-image-digest) and opens a PR via gh. If false (default), only reports findings -- fully read-only. Always false in demo mode regardless of what is passed.","example":false,"input":{"allowCustom":true,"choices":[],"label":"Open pr"},"name":"open_pr","required":false,"type":"boolean"},{"default":false,"description":"Run against three bundled fixture workflows instead of your real repository, for a zero-setup first look. Never writes anything and never opens a PR, even if open_pr=true.","example":true,"input":{"allowCustom":true,"choices":[],"label":"Demo"},"name":"demo","required":false,"type":"boolean"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/satianurag/ci-digest-guard@0.4.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.78.0"},"publishedAt":"2026-09-04T04:40:48.7591+00:00","reference":"satianurag/ci-digest-guard@0.4.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3","git","gh"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":2,"installs":0},"steps":{"count":3,"names":["discover","open_pr","scan"]},"title":"ci-digest-guard","type":"play","version":"0.4.0","visibility":"public"}