Summary

Patches a CodeRabbit review comment from PR #778 that didn't make it into the squash-merge — my reply commit landed on the branch but the PR was already merged by then.

The digest-pin gate added in #778 accepts any non-empty digest algorithm; ADR-006 specifically requires sha256. A non-sha256 ref would silently pass CI.

Now: sha256: prefix is the pass condition; any other digest algorithm emits a distinct error message naming the unexpected algorithm so the contributor knows what to fix.

Original CodeRabbit thread: #778 (comment)

Refs #739, #749.

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Component(s) Affected

• Tests (recipes/manifest_images_test.go)

Implementation Notes

Three-line change to the loop body in TestComponentManifestImagesAreDigestPinned:

-if ref.Digest != "" {
+if strings.HasPrefix(ref.Digest, "sha256:") {
     continue
 }
+if ref.Digest != "" {
+    t.Errorf("%s: image %q uses non-sha256 digest %q; ADR-006 requires @sha256:<digest>", p, img, ref.Digest)
+    continue
+}

The new branch surfaces a distinct error message for the "wrong-algorithm" case so a contributor seeing the failure knows to fix the algorithm rather than thinking the digest is missing.

Testing

unset GITLAB_TOKEN && make qualify
# Codebase qualification completed

Risk Assessment

• Low — Tightens an existing test. All current refs use sha256: (verified: 4 in-tree pins all sha256, the 7 CRD-triplet exemptions are bypassed before the digest check). No production behavior change. Easy to revert.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed (n/a — internal test gate)
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)