[rmcdaniel]

Production and development image trust

Refs durable-workflow/.github#237.

This PR now includes production-image PR #272 at cb3b9c30, together with the development-image and host CI changes. Deliver both through this one combined PR; close #272 as delivered afterward. Application locks, package versions and independently published SDK worker references are unchanged.

Current bd5a08bc corrects a stale CI bootstrap-pin assertion. The preceding 67181566 retains its failed assertion and 155 passing application tests. The current candidate has passed both native root-image smoke jobs, the development-image build and ordinary PHP/Composer source checks; remaining original SDK scenarios are still running. Current checks and the post-merge image publication/consumer acceptance remain required. No earlier component result qualifies the combined tree.

Pin all six Codespaces image inputs to reviewed multi-platform digests: Node 22.23.4, Composer 2.10.3, Docker 27.5.1, Rust 1.86.0, MariaDB 11.4 and PHP 8.4.27. Fail before the first apt-get update if the effective PHP/Composer CA stores contain either blocked subject. Verify Node before its first network use and repeat all store checks in normal image qualification. Docker/Compose/Cargo retain their existing versions and use the verified final system trust store; they are not claimed to contain an intrinsic denylist fix.

Bootstrap the image's Python venv from the official SHA-256-pinned pip 26.2.2 wheel, installing it offline with dependency resolution and version checks disabled. Verify the system and pip stores before the first networked pip install; final qualification also checks the installed SDK's certifi store. No certificate or hostname verification is disabled.

Focused actual controls:

• Cached Node 22.23.3 is refused; exact pinned Node 22.23.4 passes the version and parsed embedded-root checks.
• Exact Composer 2.10.3 plus its effective system/PHP stores passes. A generated blocked-subject CA and a malformed CA file are each refused.
• The exact pinned PHP 8.4.27 base also passes the actual PHP/Composer verifier before any package installation. The new source-order regression rejects the old floating base, separately rejects a pinned base with the old late-check order, and checks every FROM input. It rejects the last three floating inputs in the previous head. All six image-contract tests pass (69 assertions), and shell syntax passes. Runtime qualification now requires exact Docker, Compose, Cargo and Rust versions.
• A clean-OS Debian Python venv refuses the original pip floor, accepts the hash-verified offline upgrade, then verifies actual system/pip/certifi bundles after normal certifi installation.
• An earlier stock Python tooling image still had an affected OS bundle and was refused even after pip was patched. That failed control is preserved; updating pip alone is not claimed to clean the OS. The final Sample image must pass both independently.
• The initial PHP checker could not open an extensionless Composer PHAR; it now loads Composer's declared PHAR alias before inspecting the actual bundled classes. Fresh checks pass.
• The existing playground image test assumed an unpinned Rust FROM string. That assertion fails on the pinned image; its correction retains the exact Rust version and requires an immutable digest. The focused playground control passes 18 assertions, alongside all six image contracts (69 assertions). The earlier two hosted PHP jobs remain failed; their log downloads timed out, so no broader CI cause is claimed. The current follow-up changes only this test expectation, with all Dockerfile and verifier bytes unchanged from d51b9ff.

The normal CI policy-preflight job also now uses the reviewed fixed-pip bootstrap before its first pip network request. Current central validation passes. Normal candidate image build/startup checks and all repository/Sonar checks remain required. After merge, both published architectures must pass qualification before channel promotion, followed by independent manifest/provenance/effective-store acceptance. The existing published image's component acceptance does not qualify this new source. Other active Python worker/example paths remain separate open work under #237.

Both normal Composer jobs now request exact Composer 2.10.3 and execute the existing PHP/Composer trust verifier immediately after setup, before their first dependency request. The absolute workspace path also covers the microservice job's different working directory. The prior workflow fails the new control on its floating tool request; all seven image/CI contracts pass (75 assertions), with the playground control separately passing 18 assertions. The initial exported fixture omitted its workflow file because of export-ignore and is retained as a setup error, followed by the corrected exact-source counterfactual. These checks cover repository-controlled dependency requests; setup-php itself remains an explicitly trusted immutable bootstrap boundary.

[rmcdaniel]

Sonar's original 239d8fb gate failure is preserved. It identified two actionable changes: HTTPS-only redirects for the pinned wheel and merging adjacent build steps. Both are implemented in f5410b2 and require fresh normal analysis/CI.

The six docker:S8431 recommendations are deliberately accepted, with reasons stored on each issue: the verified digest selects the immutable image and the version tag documents that same reviewed identity. Docker recommends this tag@digest form. This covers Node/Composer, the final PHP base and the additional Docker/Rust/MariaDB inputs now pinned in d51b9ff. Every FROM must carry a digest in the source contract. Actual runtime versions and effective CA stores are checked separately.

The fresh issue API reports zero OPEN/CONFIRMED and six ACCEPTED at the latest read. No threshold or profile rule was disabled. Earlier failed gates remain failed, and those six dispositions do not qualify the whole source or published image; normal current-head checks and both-architecture acceptance remain required.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
9 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Delivered through the normal protected merge at 910f928. Whole tree ddbea538b1faf41a5c091641b8de71fcfe118357 exactly matches qualified bd5a08b. All 28 candidate checks pass, including both native root-image smoke jobs, the development-image build, PHP 8.4/8.5 source tests, every admitted SDK scenario and Sonar. Independent Sonar API review confirms zero new issues and nine accepted docker:S8431 tag-plus-digest findings, matching the reviewed immutable inputs; no threshold/profile adjustment. The remote source head is deleted. Fresh main and development-image publication run 39848751833 are separate and pending. Both architectures must pass published-image qualification before mutable main-channel promotion; no published-image acceptance is claimed yet. PR #272 is included here, and #271/shared #237 retain their publication/consumer follow-through.