Immutable Tags

Description

• Creates a unique tag for each image by appending the pipeline id to the image's publish tag. For context, the publish tag is the first tag listed in the image's hardening_manifest.
• This was created as a request for Party Bus during cohort which occurred near the end of 2025. Here's the related MM conversation which started the discussion: https://chat.il2.dso.mil/platform-one/pl/5yfcip31itnmiea5m1dhb7yrea

Testing

• Note: Tested with the branch immutable-tags-tweaks which was merged into this branch.
• Mario trigger: https://code-ib-mario.staging.dso.mil/ironbank-tools/tools/trigger/-/pipelines/108940

multi-arch: Project: https://code-ib-mario.staging.dso.mil/dsop/opensource/debian/debian11.x/debian-11.x Latest published image-tag:

The immutable tag from the pipeline run before:

single-arch: https://code-ib-mario.staging.dso.mil/dsop/rapidfort/nginx/-/tree/master?ref_type=heads second pipeline run:

first pipeline run: