save checkpoint. addition features and their state. check some ofthem

devops/release/docker/Dockerfile.angular-ui

@@ -8,7 +8,9 @@ ARG GIT_SHA=0000000
 ARG SOURCE_DATE_EPOCH=0
 
 FROM ${NODE_IMAGE} AS build
+ARG NODE_IMAGE
 WORKDIR /workspace
+RUN case "${NODE_IMAGE}" in *@sha256:*) ;; *) echo "NODE_IMAGE must be digest-pinned (@sha256:...)"; exit 86;; esac
 ENV CI=1 \
     SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
 COPY src/Web/StellaOps.Web/package.json src/Web/StellaOps.Web/package-lock.json ./
@@ -17,10 +19,12 @@ COPY src/Web/StellaOps.Web/ ./
 RUN npm run build -- --configuration=production
 
 FROM ${NGINX_IMAGE} AS runtime
+ARG NGINX_IMAGE
 ARG VERSION
 ARG CHANNEL
 ARG GIT_SHA
 WORKDIR /usr/share/nginx/html
+RUN case "${NGINX_IMAGE}" in *@sha256:*) ;; *) echo "NGINX_IMAGE must be digest-pinned (@sha256:...)"; exit 87;; esac
 RUN rm -rf ./*
 COPY --from=build /workspace/dist/stellaops-web/ /usr/share/nginx/html/
 COPY ops/devops/release/docker/nginx-default.conf /etc/nginx/conf.d/default.conf

devops/release/docker/Dockerfile.dotnet-service

@@ -11,10 +11,12 @@ ARG GIT_SHA=0000000
 ARG SOURCE_DATE_EPOCH=0
 
 FROM ${SDK_IMAGE} AS build
+ARG SDK_IMAGE
 ARG PROJECT
 ARG GIT_SHA
 ARG SOURCE_DATE_EPOCH
 WORKDIR /src
+RUN case "${SDK_IMAGE}" in *@sha256:*) ;; *) echo "SDK_IMAGE must be digest-pinned (@sha256:...)"; exit 86;; esac
 ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 \
     DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1 \
     NUGET_XMLDOC_MODE=skip \
@@ -33,11 +35,13 @@ RUN --mount=type=cache,target=/root/.nuget/packages \
       /p:TreatWarningsAsErrors=true
 
 FROM ${RUNTIME_IMAGE} AS runtime
+ARG RUNTIME_IMAGE
 WORKDIR /app
 ARG ENTRYPOINT_DLL
 ARG VERSION
 ARG CHANNEL
 ARG GIT_SHA
+RUN case "${RUNTIME_IMAGE}" in *@sha256:*) ;; *) echo "RUNTIME_IMAGE must be digest-pinned (@sha256:...)"; exit 87;; esac
 ENV DOTNET_EnableDiagnostics=0 \
     ASPNETCORE_URLS=http://0.0.0.0:8080
 COPY --from=build /app/publish/ ./