chainguard-dev/Update the image digest

Update the image digest when have a mutating tag

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 29, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: chainguard-dev/digestabot@33d0b78e580aa0c83fe188eb3dfad6611b662479 # v1.3.2

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
working-dir	Working directory to run the digestabot, to run in a specific path, if not set will run from the root	no	.
include-files	Files (names or globs, comma-separated) that will be scanned for digest updates.	no	.yaml,.yml,Dockerfile,Makefile,.sh,.tf,*.tfvars
token	GITHUB_TOKEN or a `repo` scoped Personal Access Token (PAT)	yes	${{ github.token }}
signoff	Add `Signed-off-by` line by the committer at the end of the commit log message.	—	false
author	The author name and email address in the format `Display Name <email@address.com>`. Defaults to the user who triggered the workflow run.	—	${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>
committer	The committer name and email address in the format `Display Name <email@address.com>`. Defaults to the GitHub Actions bot user.	—	github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
labels-for-pr	A comma or newline separated list of labels to be used in the pull request.	—	automated pr, kind/cleanup, release-note-none
branch-for-pr	The pull request branch name.	—	update-digests
title-for-pr	The title of the pull request.	—	Update images digests
description-for-pr	The description of the pull request.	—	Update images digests ```release-note NONE ```
commit-message	The message to use when committing changes.	—	Update images digests
create-pr	Create a PR or just keep the changes locally.	—	true
use-gitsign	Use gitsign to sign commits.	—	true
registry-map	Comma-separated registry prefix mappings (proxy=upstream) for digest lookups. e.g. us-docker.pkg.dev/my-proj/cgr/=cgr.dev/	no	""

Outputs

name	description
pull_request_number	Pull Request Number
json	The changes made by this action, in json format. The output follows this structure: ``` { "updates": [ { "file": ".ko.yaml", "image": "cgr.dev/chainguard/kubectl:latest-dev", "digest": "sha256:d5f340d044438351413d6cb110f6f8a2abc45a7149aa53e6ade719f069fc3b0a", "updated_digest": "sha256:cd90036b16413eed13818500ae837e6e7710a59c74144c32e1e90b0e59d22efc" } ] } ```
changed_files	A newline-separated list of files that were modified during the digest update process. Only includes files that actually had their digests updated.