fix(ci): resolve published upgrade baseline by digest

.gitea/workflows/quality.yaml

@@ -375,11 +375,26 @@ jobs:
       - name: Capture exact built image identity
         id: built-image
         run: echo "id=$(docker image inspect --format '{{.Id}}' "$SMOKE_IMAGE")" >> "$GITHUB_OUTPUT"
-      - name: Built image runtime smoke
+      - name: Verify upgrade baseline resolver
+        run: sh scripts/ci/resolve-upgrade-baseline.test.sh
+      - name: Resolve immutable upgrade baseline
+        id: upgrade-baseline
         env:
           PREVIOUS_IMAGE: ${{ vars.EVOFW_PREVIOUS_IMAGE }}
           REQUIRE_UPGRADE: ${{ !inputs.is_pull_request }}
           FIRST_RELEASE: ${{ vars.EVOFW_FIRST_RELEASE == 'true' }}
+          REPOSITORY_OWNER: ${{ github.repository_owner }}
+        run: |
+          set -eu
+          owner_lc="$(printf '%s' "$REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')"
+          export IMAGE_REPOSITORY="git.shx.one/$owner_lc/evofw"
+          baseline="$(sh scripts/ci/resolve-upgrade-baseline.sh)"
+          printf 'image=%s\n' "$baseline" >> "$GITHUB_OUTPUT"
+      - name: Built image runtime smoke
+        env:
+          PREVIOUS_IMAGE: ${{ steps.upgrade-baseline.outputs.image }}
+          REQUIRE_UPGRADE: ${{ !inputs.is_pull_request }}
+          FIRST_RELEASE: ${{ vars.EVOFW_FIRST_RELEASE == 'true' }}
           SMOKE_ARTIFACT_DIR: runtime-artifacts
           BUILT_IMAGE: ${{ steps.built-image.outputs.id }}
         run: sh scripts/ci/image-smoke.sh "$BUILT_IMAGE" "${PREVIOUS_IMAGE:-}"