fix(runtime): pin postgres DHI mirror digest

Author: terion-labs

.github/workflows/mirror-hardened-images.yml

@@ -37,7 +37,7 @@ jobs:
             target: ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22
             package: terrarium-dhi-postgres
             source_digest: sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed
-            target_digest: auto
+            target_digest: sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34
             arches: amd64,arm64
     env:
       REGISTRY_AUTH_FILE: /tmp/terrarium-containers-auth.json

ansible/roles/idp_zitadel/defaults/main.yml

@@ -15,7 +15,7 @@ terrarium_docker_hardened_images: auto
 terrarium_docker_hardened_image_mirrors: true
 terrarium_zitadel_postgres_image: ""
 terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed"
-terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22"
+terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22@sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34"
 terrarium_zitadel_postgres_image_fallback: "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308"
 terrarium_zitadel_pat_expiration: "2099-01-01T00:00:00Z"
 terrarium_zitadel_project_name: Terrarium

ansible/site.yml

@@ -58,7 +58,7 @@
     terrarium_oauth2_proxy_image_fallback: "quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd"
     terrarium_zitadel_postgres_image: ""
     terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed"
-    terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22"
+    terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22@sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34"
     terrarium_zitadel_postgres_image_fallback: "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308"
     terrarium_email: ""
     terrarium_acme_email: "{{ terrarium_email }}"

tests/ansible-bootstrap-cert.test.ts

@@ -6,7 +6,7 @@ const repoRoot = join(import.meta.dir, "..");
 const POSTGRES_DHI_IMAGE =
   "dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed";
 const POSTGRES_MIRROR_IMAGE =
-  "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22";
+  "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22@sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34";
 const POSTGRES_FALLBACK_IMAGE =
   "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308";
 

tests/hardened-image-mirror.test.ts

@@ -29,9 +29,9 @@ describe("Docker Hardened Image mirror workflow", () => {
     expect(workflow).toContain(`target_digest: ${OAUTH2_PROXY_MIRROR_DIGEST}`);
     expect(workflow).toContain(`dhi.io/postgres@${POSTGRES_DIGEST}`);
     expect(workflow).not.toContain("17.9-alpine3.22-fips");
-    expect(workflow).toContain(`ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22`);
+    expect(workflow).toContain("target: ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22");
     expect(workflow).toContain(`source_digest: ${POSTGRES_DIGEST}`);
-    expect(workflow.match(/target_digest: auto/g)).toHaveLength(1);
+    expect(workflow.match(/target_digest: sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34/g)).toHaveLength(1);
     expect(workflow.match(/arches: amd64,arm64/g)).toHaveLength(2);
 
     expect(script).toContain("skopeo inspect --raw");