applyContainerPins substitutes cached digest-pinned references for any image tags that have an entry in workflowData.ActionCache.ContainerPins. Images without a cached pin are returned unchanged. Returns both the resolved image strings (for script args) and full GHAWManifestContainer entries (for th
(images []string, workflowData *WorkflowData)
| 230 | // Returns both the resolved image strings (for script args) and full GHAWManifestContainer |
| 231 | // entries (for the manifest). |
| 232 | func applyContainerPins(images []string, workflowData *WorkflowData) ([]string, []GHAWManifestContainer) { |
| 233 | result := make([]string, len(images)) |
| 234 | pins := make([]GHAWManifestContainer, len(images)) |
| 235 | |
| 236 | var cache *ActionCache |
| 237 | if workflowData != nil { |
| 238 | cache = workflowData.ActionCache |
| 239 | } |
| 240 | |
| 241 | for i, img := range images { |
| 242 | if pin, ok := lookupContainerPin(img, cache); ok && pin.PinnedImage != "" { |
| 243 | result[i] = pin.PinnedImage |
| 244 | pins[i] = GHAWManifestContainer(pin) |
| 245 | dockerLog.Printf("Pinned container image: %s -> %s", img, pin.PinnedImage) |
| 246 | continue |
| 247 | } |
| 248 | result[i] = img |
| 249 | pins[i] = GHAWManifestContainer{Image: img} |
| 250 | } |
| 251 | return result, pins |
| 252 | } |
| 253 | |
| 254 | // mergeDockerImages appends any images from newImages that are not already present |
| 255 | // in existing, preserving order for stability. |