feat(autofix): run the verification gate in an ephemeral container

.github/scripts/resolve-sandbox-image.mjs

@@ -73,55 +73,177 @@ async function fetchLatestGhcrSemver() {
   return latest;
 }
 
-function pullImage(command, image) {
+// The `Digest: sha256:…` line docker prints for the tag it just resolved is
+// the only pull-time content identity: the post-pull inspect can race a
+// `docker tag` swap (see repoDigestOf), so the exported reference must be
+// bound to what the pull itself reported, never to inspect alone.
+export function parsePullDigest(pullOutput) {
+  return pullOutput.match(/^Digest: (sha256:[0-9a-f]{64})\s*$/m)?.[1] ?? '';
+}
+
+export function pullImage(command, image) {
   return new Promise((resolve) => {
-    const child = spawn(command, ['pull', image], { stdio: 'inherit' });
+    const child = spawn(command, ['pull', image], {
+      stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    let stdout = '';
     let settled = false;
     let timer;
-    const finish = (ok) => {
+    const finish = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve(ok);
+      resolve(result);
     };
     timer = setTimeout(() => {
       console.error(
         `::error::Timed out pulling ${image} after ${PULL_TIMEOUT_MS / 1000}s.`,
       );
       child.kill('SIGKILL');
-      finish(false);
+      finish({ ok: false, digest: '' });
     }, PULL_TIMEOUT_MS);
 
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk;
+      process.stdout.write(chunk);
+    });
     child.on('error', (error) => {
       console.error(
         `::error::Failed to start '${command} pull ${image}': ${error.message}`,
       );
-      finish(false);
+      finish({ ok: false, digest: '' });
     });
     child.on('close', (code) => {
       if (code !== 0) {
         console.error(
           `::error::'${command} pull ${image}' exited with code ${code}.`,
         );
+        finish({ ok: false, digest: '' });
+        return;
       }
-      finish(code === 0);
+      finish({ ok: true, digest: parsePullDigest(stdout) });
     });
   });
 }
 
-function exportImage(image) {
+// The repository part of an image reference: everything before the :tag /
+// @digest. A registry port keeps its colon — the tag only ever follows the
+// LAST '/'.
+export function repoOfImage(image) {
+  const withoutDigest = image.split('@')[0];
+  const lastColon = withoutDigest.lastIndexOf(':');
+  const lastSlash = withoutDigest.lastIndexOf('/');
+  return lastColon > lastSlash
+    ? withoutDigest.slice(0, lastColon)
+    : withoutDigest;
+}
+
+// Resolve a PULLED image to its content digest (repo@sha256:…). The tag
+// alone is a mutable local handle: `docker run <tag>` resolves against the
+// local store without re-pull, and a co-resident process with daemon access
+// can `docker tag` different content under the same name between resolve
+// and gate. A digest reference cannot be moved by `docker tag`/`docker build`.
+// The export must be the EXACT `<repo>@<expectedDigest>` RepoDigests entry:
+// RepoDigests is shared by every tag of the same content, so `docker tag`
+// of the pulled image adds an alphabetically-sorted entry for the new name
+// and index 0 can move OFF the pulled repo (a suffix-only digest check
+// still passes) — and retagged attacker content keeps ITS original repo, so
+// only the pulled repo + the pull's own `Digest:` line together bind the
+// export to the content the pull fetched (#9214 review).
+export function repoDigestOf(command, image, expectedDigest = '') {
+  return new Promise((resolve) => {
+    const child = spawn(
+      command,
+      ['image', 'inspect', '--format', '{{json .RepoDigests}}', image],
+      { stdio: ['ignore', 'pipe', 'pipe'] },
+    );
+    let stdout = '';
+    let settled = false;
+    let timer;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(value);
+    };
+    timer = setTimeout(() => {
+      console.error(
+        `::error::Timed out inspecting ${image} after ${FETCH_TIMEOUT_MS / 1000}s.`,
+      );
+      child.kill('SIGKILL');
+      finish('');
+    }, FETCH_TIMEOUT_MS);
+
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk;
+    });
+    child.on('error', (error) => {
+      console.error(
+        `::error::Failed to start '${command} image inspect ${image}': ${error.message}`,
+      );
+      finish('');
+    });
+    child.on('close', (code) => {
+      finish(code === 0 ? stdout.trim() : '');
+    });
+  }).then((raw) => {
+    // `null`/`[]` (no RepoDigests, a locally built image), `<no value>` and
+    // empty (the inspect failed) all mean there is no repository digest —
+    // the mutable tag is exactly what must not be exported.
+    let digests = [];
+    try {
+      const parsed = JSON.parse(raw.trim());
+      if (Array.isArray(parsed)) {
+        digests = parsed.filter((entry) => typeof entry === 'string');
+      }
+    } catch {
+      // Non-JSON output carries no digests.
+    }
+    const repo = repoOfImage(image);
+    const digest = expectedDigest
+      ? digests.find((entry) => entry === `${repo}@${expectedDigest}`) ?? ''
+      : digests.find((entry) => entry.startsWith(`${repo}@sha256:`)) ?? '';
+    if (digest.includes('@sha256:')) {
+      return digest;
+    }
+    if (digests.length > 0) {
+      throw new Error(
+        `Pulled image ${image} resolved to digests none of which is '${repo}@${expectedDigest || 'sha256:…'}' (${digests.join(', ')}); refusing to export a foreign or mutable reference.`,
+      );
+    }
+    throw new Error(
+      `Pulled image ${image} resolved to no repository digest ('${raw.trim()}'); refusing to export a mutable tag.`,
+    );
+  });
+}
+
+export function exportImage(image) {
   if (process.env.GITHUB_ENV) {
     appendFileSync(process.env.GITHUB_ENV, `QWEN_SANDBOX_IMAGE=${image}\n`);
   }
+  // Also as a step OUTPUT: $GITHUB_ENV is a file later steps can append to,
+  // so a consumer that must not be steered by branch code (the verification
+  // gate's container image) reads the expression-context value instead.
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, `image=${image}\n`);
+  }
   console.log(`QWEN_SANDBOX_IMAGE=${image}`);
 }
 
 async function main() {
   const requestedImage = validateRequestedImage(process.argv[2]);
 
   const command = process.env.SANDBOX_COMMAND || 'docker';
-  if (await pullImage(command, requestedImage)) {
-    exportImage(requestedImage);
+  const requestedPull = await pullImage(command, requestedImage);
+  if (requestedPull.ok) {
+    if (!requestedPull.digest) {
+      throw new Error(
+        `'${command} pull ${requestedImage}' reported no Digest line; refusing to export an unbound image reference.`,
+      );
+    }
+    exportImage(
+      await repoDigestOf(command, requestedImage, requestedPull.digest),
+    );
     return;
   }
 
@@ -136,10 +258,16 @@ async function main() {
   console.warn(
     `::warning::Falling back from ${requestedImage} to latest GHCR semver ${fallbackImage}; sandbox image version may differ from package version.`,
   );
-  if (!(await pullImage(command, fallbackImage))) {
+  const fallbackPull = await pullImage(command, fallbackImage);
+  if (!fallbackPull.ok) {
     throw new Error(`Fallback sandbox image failed to pull: ${fallbackImage}`);
   }
-  exportImage(fallbackImage);
+  if (!fallbackPull.digest) {
+    throw new Error(
+      `'${command} pull ${fallbackImage}' reported no Digest line; refusing to export an unbound image reference.`,
+    );
+  }
+  exportImage(await repoDigestOf(command, fallbackImage, fallbackPull.digest));
 }
 
 if (