Revert "Revert "Pin SHAs for container images""

[MichalStrehovsky]

Reverts #113248

[MichalStrehovsky]

/azp run runtime-nativeaot-outerloop

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[am11]

Perhaps only pin arm32 sparing other (high-priority) archs?

[richlander]

If we are in a rush and need to doc that NAOT Arm32 is broken for Preview 3, that's OK.

I assume we missed this because we did not run runtime-nativeaot-outerloop. Should we do that next time for this type of change? Or is this after the fact approach the best general model?

[am11]

This discussion also seems to be fitting the timeline dotnet/sdk#47580 (comment), hard to say for sure without coredump from SDK CI. I think we can merge this and monitor it for a few days if it's limited to arm32 or x64 was also affected by this.

cc @ViktorHofer

[ViktorHofer]

@MichalStrehovsky we are going to snap P3 today. Should this be included? If this is the reason for the recent crashes in dotnet/sdk#47580 (comment), it would be good to include this one in P3.

cc @carlossanlop

[MichalStrehovsky]

@MichalStrehovsky we are going to snap P3 today. Should this be included? If this is the reason for the recent crashes in dotnet/sdk#47580 (comment), it would be good to include this one in P3.

I wasn't involved in the toolset update. Only submitted this to validate the update broke native AOT Linux ARM. Hard to say if x64 is related. This was the kind of change that could affect anything and it's better to do those well before various cutoffs. I'll leave this open if someone wants to sign off and merge before cutoff, but I'll be in bed soon.

[Copilot]

Pull Request Overview

This PR reverts an earlier revert to reintroduce pinned SHA values for container images in the pipeline, ensuring image immutability and consistency.

• Re-applies SHA pinning to container images across various architectures.
• Restores the intended configuration of container images for improved reliability.

[ViktorHofer]

I'm also logging off now. @carlossanlop @jeffschwMSFT can you please try to get this into main before we snap?

[steveisok]

/ba-g Merging to unblock native aot linux arm

[jkotas]

I assume we missed this because we did not run runtime-nativeaot-outerloop. Should we do that next time for this type of change? Or is this after the fact approach the best general model?

It is the best general model. We have tiered testing system. We accept that some small percentage of PRs is going to cause unexpected breaks and will need to be reverted. There are many outerloop or out-of-repo tests, and it is not practical to run all of them before merging a PR.

We should run runtime-nativeaot-outerloop for next attempt to get this in.