Backport(0.9.x): reference declarative agents by tag; digests only for sandbox agents (#2242)

[iplay88keys]

Description

Backport of #2242 (807c5689) to release/v0.9.x.

Fixes #2055 on 0.9.x (mirrored registries that re-assign manifest digests could not resolve the link-time digest refs).

Differences from #2242

release/v0.9.x predates the Python -full runtime variant (PythonADKFullImageDigest / APP_FULL_IMAGE_TAG do not exist on this branch), so:

• resolvePythonRuntimeImage gains only the pinDigest parameter — no full parameter. The full := runtime == Go && needsSRTSettings(...) computation stays Go-only, as on this branch.
• Three digest-override flags added instead of main's four: --app-image-digest, --golang-adk-image-digest, --golang-adk-full-image-digest (env: APP_IMAGE_DIGEST, etc.). --app-full-image-digest is dropped with the variant it targets.
• New unit tests adapted to the two-arg Python signature and this branch's default registry (cr.kagent.dev; main's tests use ghcr.io).
• The golden files were regenerated with UPDATE_GOLDEN=true rather than hand-merged: each changes app@sha256:test-app → app:dev, matching the shape of the change on main.

Additionally, digest pinning is gated on the substrate platform rather than on sandbox workload mode. On main every SandboxAgent is a substrate agent (no spec.platform field), so the workload-mode gate is equivalent there; this branch also has the agent-sandbox platform, which accepts tag refs. Pinning those by digest would have kept the mirrored-registry breakage for them. Sandbox agents on the agent-sandbox platform now get tag refs like regular agents; only substrate sandbox agents pin by digest.

[Copilot]

Pull request overview

Backports the image-reference behavior from #2242 onto release/v0.9.x so declarative agents use tag-based image references (honoring --image-tag) while keeping digest pinning only where required, with new controller flags to override baked-in digests for mirrored registries.

Changes:

• Add controller flags to override link-time sandbox runtime image digests (--app-image-digest, --golang-adk-image-digest, --golang-adk-full-image-digest).
• Update declarative runtime image resolution to emit registry/repo:tag for regular agents and registry/repo@sha256:... only when digest pinning is required.
• Update unit tests and regenerate golden outputs to reflect tag-based references for regular agents.

Reviewed changes

Copilot reviewed 40 out of 40 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go/core/pkg/app/app.go	Adds new CLI flags to override sandbox runtime image digests at runtime.
go/core/internal/controller/translator/agent/deployments.go	Switches regular agents to tag-based image refs; keeps digest pinning behind a pinDigest decision path.
go/core/internal/controller/translator/agent/adk_api_translator.go	Updates documentation for link-time digests and the new runtime override flags.
go/core/internal/controller/translator/agent/runtime_test.go	Updates assertions to expect tag references for regular agents and no @sha256:.
go/core/internal/controller/translator/agent/imageconfig_test.go	Updates digest-pinning tests and adds coverage for tag-based resolution and sandbox vs regular pinning.
go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json	Golden output updated from digest-pinned app image to tag-based app image.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.