feat: build runtime releases from pinned Git branch commits

internal/api/admission.go

@@ -89,6 +89,11 @@ func (a *API) evaluateImage(ctx context.Context, id string) (imageRecord, error)
 	if count == 0 {
 		return im, nil
 	}
+	var trustedRelease int
+	err = a.s.DB.QueryRowContext(ctx, "SELECT count(*) FROM image_builds WHERE image_id=? AND version=? AND recipe_rev=? AND platform=? AND status='success' AND release_id<>'' AND release_id=? AND source_repository=? AND source_commit=?", id, im.Version, im.RecipeRev, im.Platform, actual.Config.Labels["dsh-mgr.release"], actual.Config.Labels["dsh-mgr.source"], actual.Config.Labels["dsh-mgr.commit"]).Scan(&trustedRelease)
+	if err != nil {
+		return im, err
+	}
 	im.Admission = defaultAdmission(im.Version, im.RecipeRev, im.Platform)
 	im.AdmissionReason = "no accepted compatibility evidence for this tuple"
 	if positiveAdmission(im.Admission) {
@@ -101,6 +106,10 @@ func (a *API) evaluateImage(ctx context.Context, id string) (imageRecord, error)
 	} else {
 		im.Status = "existing_only"
 	}
+	if trustedRelease > 0 {
+		im.Admission = "compatible"
+		im.AdmissionReason = "trusted pinned release passed exact image startup validation"
+	}
 	if state != "" {
 		im.Admission = state
 		im.AdmissionReason = evidence