Summary

Closes #749. Implements ADR-006 Layer 2: digest-pins every Pod-spec image reference under recipes/components/*/manifests/ that AICR overrides explicitly. Adds a CI gate enforcing the policy with an explicit, documented exemption list for CRD-triplet refs whose schemas don't accept digests. Configures Renovate to auto-rotate digests as upstream rebuilds the same tag.

Refs #739, #740 (ADR-006).

Type of Change

• New feature (non-breaking change that adds functionality)

Component(s) Affected

• Recipe data (3 manifests)
• Tests (recipes/manifest_images_test.go)
• Build/CI tooling (.github/renovate.json5)
• Docs (docs/user/container-images.md — auto-regenerated)

Implementation Notes

Three refs digest-pinned:

Digests resolved via crane digest.

Out of scope (documented):

• aws-efa/values.yaml — regional ECR (602401143452.dkr.ecr.us-west-2.amazonaws.com) requires AWS authentication to fetch a digest; no public ECR alternative exists. The same constraint affects every consumer outside AWS. The regional override pattern from PR fix(recipes): document aws-efa regional ECR override pattern #774 (fix(recipes): aws-efa hardcodes us-west-2 ECR; should template region (and partition) #764) is the right answer here; digest-pinning would not produce a more reproducible deployment for users in other regions.
• aws-ebs-csi-driver/values.yaml — only image.repository is set; the chart's appVersion supplies the tag. Per ADR-006 this is a chart-default sub-image surface (Layer 3), not an explicit override (Layer 2).
• CRD-style triplet manifests (NicClusterPolicy doca-driver, k8s-rdma-shared-dev-plugin, doca_telemetry; Skyhook Package shellscript, nvidia-tuning-gke, nvidia-setup, nvidia-tuned). The schemas separate image: from version: and do not accept @sha256: digests. Reproducibility for these refs is delivered by admission-time verification (Supply-chain provenance audit per component #745) plus the upstream signing requests filed under [Epic]: Software supply chain security: visibility, reproducibility, verification #739 Stage 3 (Publish keyless cosign signatures, SLSA provenance, and SBOM attestations for releases gpu-operator#2432, Publish keyless cosign signatures, SLSA provenance, and SBOM attestations for releases Mellanox/network-operator#2555, Publish keyless cosign signatures, SLSA provenance, and SBOM attestations for releases kubernetes-sigs/dra-driver-nvidia-gpu#1105, Publish keyless cosign signatures, SLSA provenance, and SBOM attestations for releases nodewright#224).

CI gate. New TestComponentManifestImagesAreDigestPinned in recipes/manifest_images_test.go walks every components/*/manifests/*.yaml and asserts every extracted image ref carries an @sha256: digest. The seven CRD-triplet exemptions are listed explicitly in imageDigestExemptions with reasons and upstream tracking issues. A future PR adding a tag-only manifest ref will fail the test unless either pinned to a digest or added to the exemption set with a reason. Self-documenting policy enforcement.

Renovate config. Pointed Renovate's kubernetes manager at recipes/components/*/manifests/ so digest rotations land as auto-PRs as upstream rebuilds the same tag. The helm-values manager is already active for values.yaml via its default fileMatch.

BOM doc. Auto-regenerated; image set unchanged byte-wise. The three newly-pinned refs now show their @sha256: in the per-component listing.

Testing

unset GITLAB_TOKEN && make qualify
# Codebase qualification completed

$ go test -v -run TestComponentManifestImagesAreDigestPinned ./recipes/...
=== RUN   TestComponentManifestImagesAreDigestPinned
    manifest_images_test.go:145: exempted: nvcr.io/nvidia/doca/doca_telemetry:1.22.5-doca3.1.0-host — NicClusterPolicy CRD does not accept image digests; tracked via #745 and Mellanox/network-operator#2555
    manifest_images_test.go:145: exempted: nvcr.io/nvidia/mellanox/doca-driver:doca3.2.0-25.10-1.2.8.0-2 — ...
    [... 5 more exemptions logged ...]
--- PASS: TestComponentManifestImagesAreDigestPinned

Risk Assessment

• Low — Digest-pinning to a specific image content. Same image bytes deploy as before (digest of the existing tag), just made explicit. CI gate only enforces what ADR-006 already codifies. Renovate config changes how upstream digest bumps land but doesn't affect runtime. Easy to revert.

Rollout notes: Renovate will start opening digest-rotation PRs as upstream rebuilds the same tag. Patch-flow stays the same; the diff lands as a normal CI'd PR.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality (the new TestComponentManifestImagesAreDigestPinned)
• I updated docs if user-facing behavior changed (docs/user/container-images.md auto-regenerated)
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)