[Wikid82]

Small non-blocking follow-ups from the prebuilt-toolchain-image work (#1300), tracked in #1304.

Item A — pin the regctl release version

.github/workflows/quality-checks.yml verify-toolchain-pin job installed regctl via iarekylew00t/regctl-installer with the action's default regctl-release: latest, so a new regctl release could shift this required check's behavior with no repo change. Now pinned to regctl-release: v0.11.6 (current stable, released 2026-09-02) with a comment explaining why.

Item B — widen the freshness-guard bats matrix

scripts/tests/verify-toolchain-pin.bats:

• same-repo run where the pinned :$KEY tag does not resolve in the registry -> hard exit 1 (failure-closed). New tf_stub_regctl_unresolvable helper mock (image digest exits non-zero), reusing the existing PATH-stub pattern.
• CHARON_TOOLCHAIN_DIGEST blank value and ARG line absent -> hard exit 1.

scripts/tests/toolchain-key.bats:

• per-input sensitivity for the FROM tonistiigi/xx:... pin and ARG ALPINE_IMAGE — changing either flips the recomputed key; an unchanged re-emit keeps it stable. New TF_XX_PIN / TF_ALPINE_IMAGE fixture knobs.

Also hardened verify-toolchain-pin.sh arg_value(): a missing ARG line now yields empty output instead of aborting the script under set -e before the actionable CHARON_TOOLCHAIN_DIGEST not found error can print.

bats scripts/tests/ — 27/27 green. shellcheck --severity=error clean on all changed .sh/.bash. lefthook run pre-commit clean.

Not in scope

make build-offline CI coverage and the caddy-geoip2 pin (no upstream tag yet) remain parked in #1304.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1769

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
Total	0

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}