v9.6.1 — digest-pin floating buildah/skopeo tags
quay.io/buildah/stable and quay.io/skopeo/stable rebuild their vX, vX.Y,
vX.Y.Z, and `latest` tags IN PLACE (proven 2026-08-03: v1.43.1, v1.43, v1,
and `latest` on buildah/stable all resolved to one digest pushed 31 May).
Every job in this catalog that pinned one of those tags was silently
floating -- including `seal`, which signs boot artifacts.
Digest-pinned all six occurrences to what each named tag currently resolves
to, matching the `tag@sha256` style this repo's own `.gitlab-ci.yml` already
uses for the same two images:
- `templates/seal/template.yml` (highest consequence: signs boot artifacts)
- `templates/base-build-scratch.yml`
- `templates/container-build.yml`
- `templates/image-verify/template.yml` (kept at its existing v1.41.5 --
only the floating-pin defect was in scope here)
- `templates/supply-chain.yml` (buildah + skopeo)
skopeo/stable's `-immutable` variant tag is distinct content
(sha256:4a16d57b...) from what v1.22.2/`latest` currently resolve to
(sha256:c7d3c512...) -- not a drop-in swap, so pinned to the latter to match
this catalog's own existing usage rather than silently substituting
different image content into a supply-chain component.
renovate.json's `templates/*.yml` customManager now also matches a job's
`image:`/`image.name:` key (previously it only saw `spec.inputs.*.default`
values, and only when quoted), so none of these six pins were tracked going
forward before this release. Added `versioningTemplate: docker` for correct
tag-with-suffix ordering. Two of the six floating pins (container-build.yml,
image-verify/template.yml) were found via a full-catalog grep beyond the
four originally reported, and fixed the same way.
Also carries two routine Renovate bumps merged since v9.6.0:
registry.gitlab.com/gitlab-org/cli:latest docker digest, and anchore/syft to
v1.49.0.
Patch bump: fixes a floating-pin defect (jobs resolving a mutable upstream
tag at parse time instead of a fixed digest). No input or interface change;
consumers pick it up by moving the component pin.