[Export Audit] DIGEST_PINNED_IMAGE_PATTERN - unused image validation pattern

[github-actions]

Unused Export: DIGEST_PINNED_IMAGE_PATTERN

File: src/image-resolver.ts:61
Symbol: DIGEST_PINNED_IMAGE_PATTERN (RegExp constant)
Evidence: Pre-verified with 0 external usages

Analysis

The DIGEST_PINNED_IMAGE_PATTERN regular expression is exported but never imported outside its defining file. This pattern validates digest-pinned image references (format: registry/image@sha256:...).

Verification:

grep -rw "DIGEST_PINNED_IMAGE_PATTERN" src/ --include="*.ts" | grep -vE "test|image-resolver.ts"
# Returns: no matches (0 usages outside defining file)

Dead Code Risk

Severity: MEDIUM (Score: 3 = unused public API)

• Validation bypass: Exposed validation pattern that isn't used externally risks inconsistent image reference validation
• Security surface: Image reference patterns are security-critical (prevent tag manipulation attacks) - unused exports increase attack surface
• Pattern drift: The pattern may diverge from actual validation logic if it's not actively consumed

Recommendation

1. If truly unused: Remove the export keyword
2. If used by isDigestPinnedImageReference only: Both functions are unused exports - consider removing both or making them private
3. If intended for external validation: Document the public contract and add tests showing usage

Related Context

This is the fourth unused export in image-resolver.ts:

• DIGEST_PINNED_IMAGE_PATTERN (this issue)
• isDigestPinnedImageReference (separate issue)
• DEFAULT_IMAGE_REGISTRY, DEFAULT_DIND_STAGING_IMAGE, DEFAULT_DOH_PROXY_IMAGE (separate issue)

Recommendation: Perform a holistic review of image-resolver.ts public API to determine the intended public surface.

Generated by API Surface & Export Audit · sonnet45 · 25.4 AIC · ⊞ 6.2K · ◷

• expires on Sep 23, 2026, 9:21 AM UTC