fix: pin release image base manifests

Pin the Go builder and Debian runtime to compatible multi-architecture manifest digests. Record both base image digests in release evidence and document the post-fix exact-main baseline.

Author: weicao

.github/workflows/release-image.yml

@@ -93,9 +93,43 @@ jobs:
             echo "source_sha must be reachable from main at workflow commit $WORKFLOW_SHA" >&2
             exit 1
           fi
+          mapfile -t base_images < <(
+            awk '
+              toupper($1) == "FROM" {
+                for (i = 2; i <= NF; i++) {
+                  if ($i !~ /^--/) {
+                    print $i
+                    break
+                  }
+                }
+              }
+            ' source/docker/Dockerfile
+          )
+          if [[ "${#base_images[@]}" -ne 2 ]]; then
+            echo "Dockerfile must contain exactly one builder and one runtime FROM image" >&2
+            exit 1
+          fi
+          if [[ ! "${base_images[0]}" =~ ^([^@[:space:]]+)@(sha256:[0-9a-f]{64})$ ]]; then
+            echo "builder image must include a readable tag and full sha256 manifest digest" >&2
+            exit 1
+          fi
+          builder_image="${BASH_REMATCH[1]}"
+          builder_image_digest="${BASH_REMATCH[2]}"
+          if [[ ! "${base_images[1]}" =~ ^([^@[:space:]]+)@(sha256:[0-9a-f]{64})$ ]]; then
+            echo "runtime image must include a readable tag and full sha256 manifest digest" >&2
+            exit 1
+          fi
+          runtime_image="${BASH_REMATCH[1]}"
+          runtime_image_digest="${BASH_REMATCH[2]}"
           short_sha="${SOURCE_SHA:0:8}"
-          echo "sha_tag=sha-$short_sha" >> "$GITHUB_OUTPUT"
-          echo "build_time=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"
+          {
+            echo "sha_tag=sha-$short_sha"
+            echo "build_time=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+            echo "builder_image=$builder_image"
+            echo "builder_image_digest=$builder_image_digest"
+            echo "runtime_image=$runtime_image"
+            echo "runtime_image_digest=$runtime_image_digest"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
@@ -166,6 +200,10 @@ jobs:
           BUILD_TIME: ${{ steps.metadata.outputs.build_time }}
           BUILD_DIGEST: ${{ steps.build.outputs.digest }}
           WORKFLOW_SHA: ${{ github.sha }}
+          BUILDER_IMAGE: ${{ steps.metadata.outputs.builder_image }}
+          BUILDER_IMAGE_DIGEST: ${{ steps.metadata.outputs.builder_image_digest }}
+          RUNTIME_IMAGE: ${{ steps.metadata.outputs.runtime_image }}
+          RUNTIME_IMAGE_DIGEST: ${{ steps.metadata.outputs.runtime_image_digest }}
         run: |
           set -euo pipefail
           source release-tools/.github/scripts/dockerhub-manifest.sh
@@ -242,6 +280,10 @@ jobs:
             --arg amd64_digest "$amd64_digest" \
             --arg arm64_digest "$arm64_digest" \
             --arg build_time "$BUILD_TIME" \
+            --arg builder_image "$BUILDER_IMAGE" \
+            --arg builder_image_digest "$BUILDER_IMAGE_DIGEST" \
+            --arg runtime_image "$RUNTIME_IMAGE" \
+            --arg runtime_image_digest "$RUNTIME_IMAGE_DIGEST" \
             '{
               image: $image,
               source_sha: $source_sha,
@@ -255,6 +297,16 @@ jobs:
                 "linux/amd64": $amd64_digest,
                 "linux/arm64": $arm64_digest
               },
+              base_images: {
+                builder: {
+                  image: $builder_image,
+                  digest: $builder_image_digest
+                },
+                runtime: {
+                  image: $runtime_image,
+                  digest: $runtime_image_digest
+                }
+              },
               build_time: $build_time
             }' > release-metadata.json
 
@@ -265,6 +317,8 @@ jobs:
             echo "- Version tag: \`$IMAGE:$VERSION\`"
             echo "- Commit tag: \`$IMAGE:$SHA_TAG\`"
             echo "- Digest: \`$BUILD_DIGEST\`"
+            echo "- Builder: \`$BUILDER_IMAGE@$BUILDER_IMAGE_DIGEST\`"
+            echo "- Runtime: \`$RUNTIME_IMAGE@$RUNTIME_IMAGE_DIGEST\`"
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload release evidence

docker/Dockerfile

@@ -1,5 +1,5 @@
 # Step 1: Build stage
-FROM --platform=${BUILDPLATFORM} golang:latest AS builder
+FROM --platform=${BUILDPLATFORM} golang:1.23.12-bookworm@sha256:167053a2bb901972bf2c1611f8f52c44d5fe7e762e5cab213708d82c421614db AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -55,7 +55,7 @@ RUN --mount=type=bind,target=. \
     fi
 
 # Step 2: Final stage
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241
 
 ARG TARGETARCH
 ARG VERSION=dev

docs/release.md

@@ -8,7 +8,7 @@ published image can always be traced and rolled back.
 
 | Tag | Example | Mutable | Created by |
 | --- | --- | --- | --- |
-| Development version | `v0.1.0-dev.20260821.1` | No | Release Image workflow |
+| Development version | `v0.1.0-dev.20260822.1` | No | Release Image workflow |
 | Release candidate | `v0.1.0-rc.1` | No | Release Image workflow |
 | Source commit | `sha-5e29d94d` | No | Release Image workflow |
 | Stable version | `v0.1.0` | No | Promote Image workflow after acceptance |
@@ -47,17 +47,22 @@ must resolve to the digest returned by the build. The workflow uploads
 `release-metadata.json` with the source and workflow SHAs, run ID and URL,
 immutable tags, top-level digest, per-platform digests, and build time.
 
-The first restored baseline uses:
+The application Dockerfile must pin both its builder and runtime images with a
+readable tag and a full multi-architecture manifest digest. The workflow
+rejects an unpinned Dockerfile and records both base-image digests in the
+release evidence.
+
+The first restored baseline will use:
 
 ```text
-source_sha: 5e29d94db535e51876ec9465c5ef78a8e2c2d92a
-version: v0.1.0-dev.20260821.1
-commit tag: sha-5e29d94d
+source_sha: exact main commit containing the pinned Dockerfile and release policy
+version: v0.1.0-dev.20260822.1
+commit tag: sha-<first 8 characters of source_sha>
 ```
 
-This baseline predates the `myduckserver --version` command. Its version and
-source commit must be queried from its OCI labels. Do not apply the release
-tooling commit to the baseline source tree.
+The earlier `5e29d94db535e51876ec9465c5ef78a8e2c2d92a` commit remains the fifth
+compatibility-restoration milestone, but it is not an image release source:
+its mutable builder tag now produces a binary incompatible with its runtime.
 
 ## Inspect build identity
 
@@ -119,6 +124,7 @@ Every release record must keep:
 - full application source SHA;
 - prerelease, source-commit, and stable tags as applicable;
 - multi-architecture digest;
+- builder and runtime top-level manifest digests;
 - acceptance result and reference;
 - build or promotion time;
 - previous `latest` digest for rollback.

version_test.go

@@ -28,12 +28,12 @@ func TestVersionInfo(t *testing.T) {
 		SourceRepository = originalSourceRepository
 	})
 
-	Version = "v0.1.0-dev.20260821.1"
+	Version = "v0.1.0-dev.20260822.1"
 	GitCommit = "5e29d94db535e51876ec9465c5ef78a8e2c2d92a"
 	BuildTime = "2026-08-21T15:35:20Z"
 	SourceRepository = "https://github.com/apecloud/myduckserver"
 
-	want := "myduckserver version=v0.1.0-dev.20260821.1 commit=5e29d94db535e51876ec9465c5ef78a8e2c2d92a build_time=2026-08-21T15:35:20Z source=https://github.com/apecloud/myduckserver"
+	want := "myduckserver version=v0.1.0-dev.20260822.1 commit=5e29d94db535e51876ec9465c5ef78a8e2c2d92a build_time=2026-08-21T15:35:20Z source=https://github.com/apecloud/myduckserver"
 	if got := versionInfo(); got != want {
 		t.Fatalf("versionInfo() = %q, want %q", got, want)
 	}