ci: pin actions to commit SHAs, guard Docker jobs from forks, scan the image, gate publish on security (SEC-06, SEC-07, SEC-14, SEC-15, SEC-16)

scripts/ci/cleanup_job_resources.sh

@@ -8,8 +8,12 @@
 #   * per-run networks named aegis-it-* that the job container is attached to
 #     (the integration harness joins the job container to its own per-run
 #     network only), plus the containers still attached to those networks;
-#   * containers started from the exact image refs given as arguments;
-#   * the exact image refs given as arguments.
+#   * containers started from the per-run image refs given as arguments, and
+#     those refs. Per-run refs are names containing "aegis-ci-" (named after the
+#     run id) and immutable ":sha-<commit>" tags;
+#   * for any other ref (shared tags such as :latest, :main, :dev, which a
+#     deployment on the same daemon may use) only the tag is removed. Containers
+#     are never touched, and an image still used by a container simply stays.
 # Everything is best effort (a failing removal never fails the job).
 set -uo pipefail
 
@@ -40,12 +44,24 @@ if [ -n "${job_ref}" ] && docker container inspect "${job_ref}" > /dev/null 2>&1
   done
 fi
 
+is_per_run_ref() {
+  case "$1" in
+    *aegis-ci-* | *:sha-*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 for image in "$@"; do
-  for cid in $(docker ps -aq --filter "ancestor=${image}" 2> /dev/null); do
-    docker rm -f -v "${cid}" > /dev/null 2>&1 || true
-  done
-  docker rmi "${image}" > /dev/null 2>&1 || true
-  echo "removed image ${image}"
+  if is_per_run_ref "${image}"; then
+    for cid in $(docker ps -aq --filter "ancestor=${image}" 2> /dev/null); do
+      docker rm -f -v "${cid}" > /dev/null 2>&1 || true
+    done
+    docker rmi "${image}" > /dev/null 2>&1 || true
+    echo "removed image ${image}"
+  else
+    docker image rm "${image}" > /dev/null 2>&1 || true
+    echo "untagged shared ref ${image}"
+  fi
 done
 
 exit 0