ci: stop duplicate PR builds; pin actions to SHAs

[thomasdesr]

The unit-test workflow triggered on every push and every pull request, so same-repo PR branches ran each build twice: once for the push event and once for the pull_request event.

• Limit the push trigger to main. pull_request still covers PRs, and merges to main keep their post-merge build.
• Fix the concurrency cancel-in-progress ref: it compared against refs/heads/master, but the default branch is main, so builds on main were cancellable. They no longer are.
• Pin setup-go, setup-crane, and checkout to commit SHAs and set persist-credentials: false on checkout. These were pre-existing zizmor findings in this file; it now reports none.

If any required status check comes from the push-triggered runs on PR branches, it will stop appearing once this lands; require the pull_request checks instead.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[thomasdesr]

🤖 Opened against the wrong repo (meant for the anyscale fork), sorry for the noise.

[gemini-code-assist]

Code Review

This pull request introduces support for OCI layouts and multi-arch image indexes, adds new container run options (such as network, sysctls, and drop capabilities), and updates the Bazel integration to use Bzlmod. It also enhances the CLI with a new --test-report-format flag and secures the Tar driver against directory traversal escapes. The review feedback highlights two important issues: a potential regression where an empty platform string causes platform parsing to fail on multi-arch layouts, and a resource leak in the integration test script where a temporary directory is not cleaned up.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If platform is empty (which is now the default in both the Bazel rule and the CLI), v1.ParsePlatform("") will fail with an error.

To prevent this regression and support running tests on multi-arch OCI layouts without requiring an explicit platform flag, we should default platform to a sensible value (such as "linux/" + runtime.GOARCH) when it is empty.

Please import "runtime" and default the platform when empty.

	if desc.MediaType.IsIndex() {
		if platform == "" {
			platform = "linux/" + runtime.GOARCH
		}
		requirements, err := v1.ParsePlatform(platform)
		if err != nil {
			return nil, v1.Descriptor{}, errors.Wrapf(err, "parsing platform %q", platform)
		}
	}

[gemini-code-assist]

The temporary directory tmp_index created via mktemp -d on line 288 is never deleted, which leaks temporary directories on the host machine.

Please clean it up after the test completes.

Suggested change

	echo "PASS: oci image index test case"
	fi
	echo "PASS: oci image index test case"
	fi
	rm -rf "$tmp_index"