[docs] docs: update --image-tag CLI reference for digest-aware format

[github-actions]

Documentation Sync — 2026-04-19

This PR synchronizes docs-site/src/content/docs/reference/cli-reference.md with the digest-aware --image-tag feature shipped in commit 52969fc.

Changes Made

• Updated docs-site/src/content/docs/reference/cli-reference.md:
  • Quick-reference table entry for --image-tag now shows the full digest-metadata format instead of just "Container image tag"
  • Expanded the ### --image-tag <tag> section with a full description of the digest-pinning format, when to use it, and which digest key maps to which --agent-image preset
  • Updated the predownload subcommand table to list all five supported image keys (squid, agent, agent-act, api-proxy, cli-proxy) and cross-link to the main --image-tag section

Code Changes Referenced

• Commit 52969fc: Add digest-aware AWF runtime image pinning via image-tag metadata — introduced src/image-tag.ts, updated action.yml outputs, and partially updated docs/github_actions.md and docs/usage.md, but left docs-site/src/content/docs/reference/cli-reference.md with stale one-liner descriptions

Verification

• Format string verified against src/image-tag.ts (IMAGE_DIGEST_KEYS constant)
• Preset-to-key mapping verified against src/cli.ts option description
• Consistent with existing table style in the file

Generated by Documentation Maintainer · ● 889.7K · ◷

[github-actions]

Smoke test report\n- Add digest-aware AWF runtime image pinning via image-tag metadata\n- Optimize security-guard Claude token usage via prompt cache alignment and smaller diff payloads\nResults: merged-PR-review ✅ | safeinputs-gh-query ✅ | playwright-title ✅ | tavily-search ❌ | file-write ✅ | bash-cat ✅ | discussion-comment ✅ | npm-build ✅\nOverall status: FAIL

Warning

⚠️ Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• chatgpt.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "chatgpt.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 1f15bda

[github-actions]

Smoke Test Results

✅ GitHub MCP: PR #2086, PR #2085
✅ Playwright: GitHub page title verified
✅ File Writing: Test file created
✅ Bash Tool: File verified

Status: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

🔥 Smoke Test Results

• ✅ GitHub MCP: PR fetched — "Add digest-aware AWF runtime image pinning via image-tag metadata"
• ✅ GitHub.com connectivity: HTTP 200
• ✅ File write/read: smoke-test-copilot-24629144049.txt verified

Overall: PASS

PR author: @app/github-actions · No assignees.

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP (list_pull_requests)	✅ Latest merged PR: #2086 "Add digest-aware AWF runtime image pinning via image-tag metadata"
GitHub.com connectivity	⚠️ Pre-step data unavailable (template not expanded)
File write/read	⚠️ Pre-step data unavailable (template not expanded)
BYOK inference	✅ Responding via api-proxy → api.githubcopilot.com

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.
Author: @app/github-actions. No assignees.

Overall: PARTIAL (2 pre-step values unavailable due to unexpanded template variables)

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

Smoke Test: GitHub Actions Services Connectivity ✅

All connectivity checks passed:

Check	Result
Redis PING (host.docker.internal:6379)	✅ PONG
PostgreSQL ready (host.docker.internal:5432)	✅ accepting connections
PostgreSQL SELECT 1 (smoketest db, postgres user)	✅ returned 1

Note: redis-cli was not available in the environment, but Redis connectivity was verified via raw TCP socket (/dev/tcp) which returned +PONG.

🔌 Service connectivity validated by Smoke Services

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note: gh repo clone commands failed with pthread_create: Resource temporarily unavailable (thread limit in sandbox). Repositories were cloned successfully using git clone directly. Java Maven required -Dmaven.repo.local override as ~/.m2 was owned by root.

Generated by Build Test Suite for issue #2095 · ● 963.2K · ◷