القائمة
Container image reference format and pinning conventions. Activates when updating FROM lines, image tags, or base image references in Dockerfiles, build-args, or PipelineRun params.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Safety rules for modifying Dockerfiles and Containerfiles. Use when editing container build files.
MR/PR context gathering and diagnostic reporting guidelines. Activates when working on events that reference MRs/PRs or when reporting investigation findings.
Team coordination for implement and test modes. Developer and QE use team_send_results for final reports, team_huddle for mid-task questions to FRIDAY.
GitOps workflow rules for modifying infrastructure via git. Use when cloning repos, modifying Helm values, committing, pushing, or verifying deployments.
MR/PR lifecycle operations -- pipeline check, retest, merge, conflict reporting. Extends darwin-gitlab-ops.
Report findings and status updates to the Darwin FRIDAY. Use team_send_results for final reports (task modes). In message mode, use team_send_message instead.
| name | darwin-image-pinning |
| description | Container image reference format and pinning conventions. Activates when updating FROM lines, image tags, or base image references in Dockerfiles, build-args, or PipelineRun params. |
| roles | ["developer","sysadmin"] |
| modes | ["implement","execute"] |
All container image references MUST include both a human-readable tag AND a digest:
<registry>/<repository>:<tag>@<digest>
The tag provides readability (which version). The digest provides immutability (exactly which build). A tag alone is a floating pointer that can change underneath you. A digest alone is immutable but unreadable.
tag@sha256:digest -- keep that format:a1b2c3d) -- use the same SHA format:v1.26.0) -- use semver:rhel_9_1.26) -- use the same stream patternImage references appear in multiple locations depending on the repository structure:
Dockerfile / Containerfile -- FROM linesbuild-args.conf -- build-time argument overrides.tekton/*.yaml -- PipelineRun param valueskustomization.yaml -- newTag / newName fieldsWhen updating, grep the entire repository for the old tag to find all occurrences. A partial update (some files pinned, others still floating) breaks reproducibility.
After updating, confirm: