fix(release): require deterministic stack gate

Require stable package dispatches to run make release-gate, add a stack-consistency check for matched runtime refs and builder image identity, pin workflow actions by SHA, attest release packages, and refresh GPU docs/handoffs around the Apple virtio-gpu runtime shape.

Release-Highlight: Stable releases now require make release-gate, which runs full CI plus Docker Compose parity before package dispatch.

Release-Highlight: Records the matched container b1917fb, containerization 41252f2, and builder-shim dbe6de4 stack refs, including the digest-pinned builder image.

Release-Highlight: Documents Compose gpus as Apple virtio-gpu support with runtime-discovered guest DRM projection, not Metal/CUDA/vendor passthrough. Upstream references: apple/container#1511, apple/containerization#480, apple/containerization#569, apple/container-builder-shim#87.

Refs: apple/container#1511, apple/containerization#480, apple/containerization#569, apple/container-builder-shim#87

Author: stephenlclarke

.github/workflows/ci.yml

@@ -48,7 +48,7 @@ jobs:
     steps:
       - name: Checkout for push diff
         if: github.event_name == 'push'
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
@@ -103,13 +103,32 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           path: container-compose
           fetch-depth: 0
 
+      - name: Resolve container ref
+        id: container-ref
+        shell: bash
+        run: |
+          set -euo pipefail
+          ref="$(python3 container-compose/Tools/release/resolve-container-ref.py)"
+          if [[ -z "$ref" ]]; then
+            printf 'container ref is empty\n' >&2
+            exit 1
+          fi
+          printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout container dependency
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          repository: stephenlclarke/container
+          path: container
+          ref: ${{ steps.container-ref.outputs.ref }}
+
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: container-compose/Tools/compose-normalizer/go.mod
           cache-dependency-path: container-compose/Tools/compose-normalizer/go.sum
@@ -118,7 +137,7 @@ jobs:
         run: npm install --global markdownlint-cli@0.48.0
 
       - name: Cache local repo tools
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: container-compose/.local/bin
           key: ${{ runner.os }}-${{ runner.arch }}-local-tools-hawkeye-v6.5.1
@@ -138,7 +157,7 @@ jobs:
     timeout-minutes: 75
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           path: container-compose
           fetch-depth: 0
@@ -176,15 +195,15 @@ jobs:
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
       - name: Checkout container dependency
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/container
           path: container
           ref: ${{ steps.container-ref.outputs.ref }}
 
       - name: Checkout containerization dependency
         if: steps.stack-refs.outputs.containerization_ref != ''
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/containerization
           path: containerization
@@ -231,7 +250,7 @@ jobs:
           } | shasum -a 256 | awk '{ printf "fingerprint=%s\n", $1 }' >> "$GITHUB_OUTPUT"
 
       - name: Cache SwiftPM build artifacts
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: |
             container-compose/.build
@@ -247,7 +266,7 @@ jobs:
         working-directory: container-compose
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: container-compose/Tools/compose-normalizer/go.mod
           cache-dependency-path: container-compose/Tools/compose-normalizer/go.sum
@@ -289,7 +308,7 @@ jobs:
 
       - name: Cache SonarQube packages
         if: github.ref == 'refs/heads/main'
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
@@ -389,7 +408,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Install Markdown lint
         run: npm install --global markdownlint-cli@0.48.0

.github/workflows/codeql.yml

@@ -50,7 +50,7 @@ jobs:
     steps:
       - name: Checkout for push diff
         if: github.event_name == 'push'
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
@@ -103,18 +103,18 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: Tools/compose-normalizer/go.mod
           cache-dependency-path: Tools/compose-normalizer/go.sum
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@1ad29ea4a422cce9a242a9fae469541dcd08addc # v4
         with:
           languages: go
           build-mode: manual
@@ -125,7 +125,7 @@ jobs:
         run: make go-build
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@1ad29ea4a422cce9a242a9fae469541dcd08addc # v4
         with:
           category: "/language:go"
 

.github/workflows/homebrew.yml

@@ -48,7 +48,7 @@ jobs:
     runs-on: macos-26
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Validate Ruby syntax
         shell: bash

.github/workflows/prebuilt-binaries.yml

@@ -31,7 +31,9 @@ on:
 
 permissions:
   actions: read
+  attestations: write
   contents: write
+  id-token: write
 
 concurrency:
   group: prebuilt-binaries-${{ github.event.workflow_run.head_branch || inputs.ref || github.ref_name }}
@@ -165,7 +167,7 @@ jobs:
     runs-on: macos-26
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           path: container-compose
           fetch-depth: 0
@@ -286,7 +288,7 @@ jobs:
 
       - name: Checkout container-builder-shim dependency
         if: steps.stack-refs.outputs.container_builder_shim_ref != ''
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/container-builder-shim
           path: container-builder-shim
@@ -295,15 +297,15 @@ jobs:
 
       - name: Checkout containerization dependency
         if: steps.stack-refs.outputs.containerization_ref != ''
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/containerization
           path: containerization
           fetch-depth: 0
           ref: ${{ steps.stack-refs.outputs.containerization_ref }}
 
       - name: Checkout container dependency
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/container
           path: container
@@ -339,39 +341,26 @@ jobs:
         working-directory: container-compose
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: container-compose/Tools/compose-normalizer/go.mod
           cache-dependency-path: container-compose/Tools/compose-normalizer/go.sum
 
-      - name: Wait for CI result
-        id: ci-result
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          python3 container-compose/Tools/ci/wait-for-workflow-success.py \
-            --repo "${GITHUB_REPOSITORY}" \
-            --workflow ci.yml \
-            --sha "${{ needs.resolve-publish-context.outputs.sha }}" \
-            --timeout-seconds 900 \
-            --poll-seconds 15
-
       - name: Install Markdown lint
-        if: github.event_name == 'workflow_dispatch' && steps.ci-result.outputs.passed != 'true'
+        if: github.event_name == 'workflow_dispatch'
         run: npm install --global markdownlint-cli@0.48.0
 
       - name: Cache local repo tools
-        if: github.event_name == 'workflow_dispatch' && steps.ci-result.outputs.passed != 'true'
-        uses: actions/cache@v6
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: container-compose/.local/bin
           key: ${{ runner.os }}-${{ runner.arch }}-local-tools-hawkeye-v6.5.1
 
       - name: Run release validation
-        if: github.event_name == 'workflow_dispatch' && steps.ci-result.outputs.passed != 'true'
-        timeout-minutes: 45
-        run: make ci
+        if: github.event_name == 'workflow_dispatch'
+        timeout-minutes: 90
+        run: make release-gate
         working-directory: container-compose
         env:
           HAWKEYE_AUTO_INSTALL: "1"
@@ -384,8 +373,13 @@ jobs:
           CONTAINER_COMPOSE_COMMIT: ${{ needs.resolve-publish-context.outputs.sha }}
           CONTAINER_COMPOSE_LANE: ${{ steps.lane.outputs.package_lane }}
 
+      - name: Attest release package
+        uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 # v3
+        with:
+          subject-path: ${{ runner.temp }}/${{ steps.lane.outputs.asset }}
+
       - name: Upload workflow artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: ${{ steps.lane.outputs.asset }}
           path: |
@@ -515,7 +509,7 @@ jobs:
 
       - name: Checkout Homebrew tap
         if: steps.lane.outputs.update_tap == 'true' && steps.tap-token.outputs.available == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/homebrew-tap
           path: homebrew-tap

.github/workflows/quality.yml

@@ -65,7 +65,7 @@ jobs:
     steps:
       - name: Checkout for push diff
         if: github.event_name == 'push'
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
@@ -128,7 +128,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           path: container-compose
           fetch-depth: 0
@@ -166,15 +166,15 @@ jobs:
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
       - name: Checkout container dependency
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/container
           path: container
           ref: ${{ steps.apple-container-ref.outputs.ref }}
 
       - name: Checkout containerization dependency
         if: steps.stack-refs.outputs.containerization_ref != ''
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/containerization
           path: containerization
@@ -220,7 +220,7 @@ jobs:
           } | shasum -a 256 | awk '{ printf "fingerprint=%s\n", $1 }' >> "$GITHUB_OUTPUT"
 
       - name: Cache SwiftPM ASan artifacts
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: |
             container-compose/.build
@@ -241,7 +241,7 @@ jobs:
           xcodebuild -version
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: container-compose/Tools/compose-normalizer/go.mod
           cache-dependency-path: container-compose/Tools/compose-normalizer/go.sum
@@ -261,7 +261,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           path: container-compose
           fetch-depth: 0
@@ -299,15 +299,15 @@ jobs:
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
       - name: Checkout container dependency
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/container
           path: container
           ref: ${{ steps.apple-container-ref.outputs.ref }}
 
       - name: Checkout containerization dependency
         if: steps.stack-refs.outputs.containerization_ref != ''
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: stephenlclarke/containerization
           path: containerization
@@ -353,7 +353,7 @@ jobs:
           } | shasum -a 256 | awk '{ printf "fingerprint=%s\n", $1 }' >> "$GITHUB_OUTPUT"
 
       - name: Cache SwiftPM TSan artifacts
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: |
             container-compose/.build
@@ -374,7 +374,7 @@ jobs:
           xcodebuild -version
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: container-compose/Tools/compose-normalizer/go.mod
           cache-dependency-path: container-compose/Tools/compose-normalizer/go.sum
@@ -394,7 +394,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout container-compose
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0