fix(ci): preserve required checks for base updates

Keep the protected branch's existing check contexts running against the known-good Fedora 44 digest. The base-image workflow overrides that default with its explicit candidate image and validates the full pipeline before publishing.

Author: robarnold

.devcontainer/Containerfile

@@ -1,4 +1,4 @@
-ARG DEVCONTAINER_BASE_TAG=latest
+ARG DEVCONTAINER_BASE_IMAGE=ghcr.io/marinatedconcrete/devcontainer-base:latest@sha256:9653d9dc6d4e11e803442622dcf3bd8f11b872553547b5546d517b370dfc6301
 
 FROM ghcr.io/hadolint/hadolint:v2.14.0@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e AS hadolint
 FROM registry.k8s.io/kustomize/kustomize:v5.8.1@sha256:899fcd3bc898160e62bcaf82932b0cb29ba38d16272353db2e7acbba82129429 AS kustomize
@@ -8,7 +8,7 @@ COPY .devcontainer/build_files /
 COPY ansible/requirements.txt /requirements.txt
 
 # hadolint ignore=DL3007
-FROM ghcr.io/marinatedconcrete/devcontainer-base:${DEVCONTAINER_BASE_TAG}
+FROM ${DEVCONTAINER_BASE_IMAGE}
 
 USER root
 

.devcontainer/devcontainer.json

@@ -2,7 +2,7 @@
   "name": "config",
   "build": {
     "args": {
-      "DEVCONTAINER_BASE_TAG": "${localEnv:DEVCONTAINER_BASE_TAG:latest}"
+      "DEVCONTAINER_BASE_IMAGE": "${localEnv:DEVCONTAINER_BASE_IMAGE:ghcr.io/marinatedconcrete/devcontainer-base:latest@sha256:9653d9dc6d4e11e803442622dcf3bd8f11b872553547b5546d517b370dfc6301}"
     },
     "cacheFrom": "ghcr.io/marinatedconcrete/config-devcontainer",
     "context": "..",

.github/workflows/checks.yml

@@ -2,9 +2,6 @@
 name: Run checks
 on:
   push:
-    paths-ignore:
-      - .github/workflows/image-devcontainer-base.yml
-      - images/devcontainer-base/**
 
 jobs:
   build:

.github/workflows/image-devcontainer-base.yml

@@ -28,7 +28,7 @@ jobs:
       contents: read
       packages: write
     env:
-      DEVCONTAINER_BASE_TAG: candidate-${{ github.sha }}
+      DEVCONTAINER_BASE_IMAGE: ghcr.io/${{ github.repository_owner }}/devcontainer-base:candidate-${{ github.sha }}
 
     steps:
       - name: Checkout Repo
@@ -46,7 +46,7 @@ jobs:
           file: images/devcontainer-base/Containerfile
           load: true
           push: false
-          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:${{ env.DEVCONTAINER_BASE_TAG }}
+          tags: ${{ env.DEVCONTAINER_BASE_IMAGE }}
       - name: Validate Full CI Pipeline
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
         with:
@@ -60,6 +60,6 @@ jobs:
         if: github.event_name != 'pull_request'
         run: |
           docker tag \
-            "ghcr.io/${{ github.repository_owner }}/devcontainer-base:${DEVCONTAINER_BASE_TAG}" \
+            "${DEVCONTAINER_BASE_IMAGE}" \
             ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest
           docker push ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest