fix(ci): harden core tool watch issue reconciliation

[lelia]

What changed

• Run full watch/reconciliation mode on relevant main pushes, while keeping pull requests in build-guard mode.
• Reconcile one canonical core-tool-drift issue: update/reopen it when drift exists, refresh and close it when drift is resolved, and avoid resolving it when release discovery is incomplete.
• Discover Trivy releases from the repo-authorized private ghcr.io/socketdev/trivy package produced by SocketDev/trivy-dist, with packages: read, instead of Aqua's release feed.
• Rename the existing Socket row to Socket SDK (socket-sdk-python) and add rows for Socket Python CLI (socket-python-cli) and Socket npm CLI (socket-cli).
• Pin the npm socket CLI in every image and pin socketsecurity in app_tests; also watch Dockerfile.heavy.
• Remove the publish-docker workflow's create-release job. Image publishing now ends after manifest verification, leaving GitHub release authoring intentionally manual.
• Correct .github/release.yml to describe its remaining role in the manual release-note UI.
• Reduce public workflow commentary to concise maintenance context; detailed operator guidance has been extracted outside Git tracking.

Root cause

The post-release run was triggered by a push, which selected mode=build. That mode intentionally skipped latest-version discovery, and the issue step only ran for watch-mode reports with active drift. The job therefore generated and uploaded a fresh report but never reconciled issue #93, leaving its pre-merge pins in place.

Impact

After this lands, a relevant merge to main immediately refreshes issue #93. If every tracked tool is current, the workflow updates the body and closes the issue; later drift reuses and reopens the same issue rather than creating duplicates. Transient feed failures are called out in the report and cannot falsely resolve drift.

The Docker publish workflow no longer starts a runner for an automatic GitHub release step that is expected to no-op. Maintainers remain responsible for authoring each release and may still use GitHub's generated notes manually.

Operational rationale and recovery procedures no longer live alongside the public workflow implementation. The watcher also passes its selected mode through the step environment instead of expanding the output directly in the shell command.

Validation

• uv run --no-sync pytest -q — 223 passed
• actionlint .github/workflows/core-tool-watch.yml
• actionlint .github/workflows/publish-docker.yml
• zizmor .github/workflows/core-tool-watch.yml .github/workflows/publish-docker.yml — no findings
• git diff --check
• Local build-mode report exercised all six pinned tool coordinates and emitted discovery_complete=true

---

Note

Medium Risk
Changes CI supply-chain gates, GHCR release discovery, and Docker image tool pins; incorrect reconciliation or discovery logic could miss drift or close issues prematurely, though incomplete discovery is explicitly guarded.

Overview
Fixes core-tool-watch so merges to main run watch mode (not build-only), which lets post-merge runs refresh and reconcile the canonical core-tool-drift issue instead of leaving stale bodies open.

Issue reconciliation now updates/reopens when drift exists, closes when pins are current, and refuses to close when discovery_complete is false; it reuses one labeled issue (open first, then closed fallback).

check_core_tools.py expands coverage to Dockerfile.heavy, pins Socket npm and Python CLIs, tracks Trivy via TRIVY_IMAGE with latest from GHCR SocketDev/trivy, and emits discovery_complete for the workflow.

Dockerfiles pin socket@${SOCKET_NPM_CLI_VERSION} everywhere and split heavy Python CLI as SOCKET_PYTHON_CLI_VERSION.

publish-docker drops automatic create-release; .github/release.yml is documented for manual release notes only.

^{Reviewed by Cursor Bugbot for commit 3b9f342. Configure here.}

[lelia]

bugbot run

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3b9f342. Configure here.}

[David Larsen (dc-larsen)]

Approving. Traced the mode flip and the reconciliation branches:

• --fail-on-malware only trips on pinned coordinates (check_core_tools.py:615-618), so routing push-to-main to watch mode keeps the same failure surface as build mode and adds reconciliation on top. No new blocking on an upstream release we haven't adopted.
• The guard on empty report / non-boolean outputs covers the always() path where the scan dies before writing $GITHUB_OUTPUT. Outputs are written before the fail-on-malware exit, so a malware-detecting run still reconciles.
• discovery_complete gating is right: a _ghcr_latest miss yields drift=false + discovery_complete=false, which lands in the refresh-body-leave-state branch rather than closing.
• Drift compares _strip_v on both sides, so a v-prefixed GHCR tag winning the max() tie-break can't produce phantom drift.
• Dropping 2>/dev/null || true from the issue lookup is the right call under bash -e: an API hiccup now fails the step instead of silently creating a duplicate issue.

One note, not blocking: build mode short-circuits discovery_complete to true, so the local build-mode validation didn't exercise the new GHCR versions API path. First scheduled watch is the real test of whether socket-basics' GITHUB_TOKEN can read the private SocketDev/trivy package. It fails safe if not.