ci: enforce digest-only dev releases

2026-08-27 13:57:27 +03:00
parent d23951fd6d
commit 5ec7c411a0
3 changed files with 40 additions and 1 deletions
--- a/scripts/ci/release-service.sh
+++ b/scripts/ci/release-service.sh
@@ -67,7 +67,7 @@ require_safe_value \
  "RELEASE_SERVICE_PATH" "${release_service_path}" '^/[A-Za-z0-9._/-]+$'
 case "${release_service_path}" in
  /opt/ecos-dev/release-service)
-    image_ref_pattern='^[A-Za-z0-9._:/-]+:dev-[a-f0-9]{7,40}$'
+    image_ref_pattern='^[A-Za-z0-9._:/-]+@sha256:[a-f0-9]{64}$'
    [[ "${refresh_data}" == false ]] || fail "dev releases cannot refresh data"
    ;;
  /opt/ecos-main/release-service)