check-a-container-image-tag
Check a container image tag by resolving its digest, registry, platform manifest, provenance, signature, and deployment use. Use when a mutable label must be tied to an exact artifact.
소스 정보
- 저장소
- protosphinx/sphinxstack
- 최근 소스 활동
- 2026년 7월 29일 13:55
- 감지된 SKILL.md 언어
- 영어
- 스타
- 3
- 포크
- 0
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
파일 탐색기
2 개 파일SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- check-a-container-image-tag
- category
- code
- description
- Check a container image tag by resolving its digest, registry, platform manifest, provenance, signature, and deployment use. Use when a mutable label must be tied to an exact artifact.
# check-a-container-image-tag
## When to use
- Use during release, incident, rollback, or environment comparison.
- Do not pull or execute an untrusted image on a privileged host.
## Preconditions
- Record registry, repository, tag, platform, credentials scope, time, and expected digest.
## Procedure
1. Resolve the tag from the authoritative registry without execution.
2. Record index and platform-specific digests plus media types.
3. Inspect creation metadata, source revision, SBOM, provenance, and signatures.
4. Compare deployment references and node-cached digests.
5. Detect tag mutation, platform divergence, registry mirror, and stale pull policy.
6. Recommend digest pinning or correction with rollback evidence.
## Failure plan
- Quarantine when provenance, signature, or expected digest cannot be established.
## Worked example
The same tag points to a new arm64 manifest while x86 remains old, explaining architecture-specific behavior.
## Done
- An image-tag report records registry, tag, digests, platforms, provenance, signatures, and deployment references
- Mutation, mirror, platform, cache, signature, SBOM, expected-digest, and safe-inspection checks verify identity
GitHub에서 보기