菜单
Container image reference format and pinning conventions. Activates when updating FROM lines, image tags, or base image references in Dockerfiles, build-args, or PipelineRun params.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Safety rules for modifying Dockerfiles and Containerfiles. Use when editing container build files.
MR/PR context gathering and diagnostic reporting guidelines. Activates when working on events that reference MRs/PRs or when reporting investigation findings.
Team coordination for implement and test modes. Developer and QE use team_send_results for final reports, team_huddle for mid-task questions to FRIDAY.
GitOps workflow rules for modifying infrastructure via git. Use when cloning repos, modifying Helm values, committing, pushing, or verifying deployments.
MR/PR lifecycle operations -- pipeline check, retest, merge, conflict reporting. Extends darwin-gitlab-ops.
Report findings and status updates to the Darwin FRIDAY. Use team_send_results for final reports (task modes). In message mode, use team_send_message instead.
| name | darwin-image-pinning |
| description | Container image reference format and pinning conventions. Activates when updating FROM lines, image tags, or base image references in Dockerfiles, build-args, or PipelineRun params. |
| roles | ["developer","sysadmin"] |
| modes | ["implement","execute"] |
All container image references MUST include both a human-readable tag AND a digest:
<registry>/<repository>:<tag>@<digest>
The tag provides readability (which version). The digest provides immutability (exactly which build). A tag alone is a floating pointer that can change underneath you. A digest alone is immutable but unreadable.
tag@sha256:digest -- keep that format:a1b2c3d) -- use the same SHA format:v1.26.0) -- use semver:rhel_9_1.26) -- use the same stream patternImage references appear in multiple locations depending on the repository structure:
Dockerfile / Containerfile -- FROM linesbuild-args.conf -- build-time argument overrides.tekton/*.yaml -- PipelineRun param valueskustomization.yaml -- newTag / newName fieldsWhen updating, grep the entire repository for the old tag to find all occurrences. A partial update (some files pinned, others still floating) breaks reproducibility.
After updating, confirm: