From e69d6b07a89a031ac3695fb4b30ced07ca87cac1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 17:07:54 +0000
Subject: [PATCH 1/2] Initial plan


From 79462c8d8145ec33f1e669b34fbd4278a9b13604 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 24 Aug 2026 17:10:12 +0000
Subject: [PATCH 2/2] test: cover private image validation internals

---
 src/image-resolver.test.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/image-resolver.test.ts b/src/image-resolver.test.ts
index 24ceb54fc..fef88d939 100644
--- a/src/image-resolver.test.ts
+++ b/src/image-resolver.test.ts
@@ -33,6 +33,11 @@ describe('custom runtime image manifest', () => {
     expect(imageResolverExports).not.toHaveProperty('DEFAULT_DOH_PROXY_IMAGE');
   });
 
+  it('keeps digest-pinned image validation internals private', () => {
+    expect(imageResolverExports).not.toHaveProperty('DIGEST_PINNED_IMAGE_PATTERN');
+    expect(imageResolverExports).not.toHaveProperty('isDigestPinnedImageReference');
+  });
+
   it('resolves only the digest-pinned configured image', () => {
     const result = resolveRuntimeImage(
       config({ squid: image('squid') }),