The documentation states that Python 3.14 is installed, but Python 3.14 has not been released yet (as of February 2026, Python 3.14 is still in development). The deadsnakes PPA may not have a stable Python 3.14 release available, which could cause the build to fail. Verify that Python 3.14 is actually available from the deadsnakes PPA, or update the documentation and Containerfile to remove this version until it's officially released.

The dive scan expects the image to be loaded into the Docker daemon, but the load command on line 98 uses 2>/dev/null || true which silently ignores all errors. If the OCI archive is corrupted or incompatible, the load will fail silently, and the subsequent docker tag on line 99 will also fail silently. This means the dive scan on line 104 will fail with a confusing error about the image not being found. Remove the || true or add explicit error checking to ensure the image is successfully loaded before attempting to scan it.

The hadolint validation step doesn't use the .hadolint.yaml configuration file that exists in the repository. The CI workflow (ci.yaml) uses hadolint/hadolint-action@v3.1.0 which automatically picks up the config, but this step uses a plain Docker run command without specifying the config file. Add --config .hadolint.yaml to the docker run command or mount the config file to ensure consistent linting behavior between CI and release workflows.

Multiple consecutive RUN commands for skopeo (lines 28-33) and buildah (lines 35-40) each perform apt-get update separately. This creates unnecessary image layers and increases build time. Consider combining these apt-get installations into a single RUN command to reduce layers and improve build efficiency. This would also align with Docker best practices for minimizing layer count.

The CI workflow's test build uses docker build which doesn't pass any of the build args defined in manifest.yaml (RUNNER_VERSION, ARGO_VERSION, etc.). This means the test build won't accurately reflect the actual build process used in the release workflow, potentially missing build failures related to these arguments. Consider using the same build approach as release.yaml or at least passing the build args from manifest.yaml.

The hadolint-docker hook uses a custom entry that runs the hadolint container, but this approach may not work correctly with pre-commit's hook execution model. The entry hadolint/hadolint hadolint appears to be malformed - it should either use the hadolint Docker image properly or use the hadolint binary directly. Consider using the standard hadolint hook configuration or verify this custom entry works as intended in local testing.

The version parsing logic assumes semantic versioning with at least two dots (MAJOR.MINOR.PATCH format). If the release version is "1.0" instead of "1.0.0", the MAJOR_MINOR variable on line 126 will be "1" (same as MAJOR), and MAJOR on line 127 will be empty, causing the subsequent skopeo copy commands to fail or push to incorrect tags. Add validation to ensure the version has the expected format, or make the parsing more robust to handle version strings with fewer components.

Using RUNNER_VERSION=latest as the default base image version introduces unpredictability and potential breaking changes. The GitHub Actions runner image could be updated at any time with breaking changes, causing builds to fail unexpectedly. Consider pinning to a specific version tag (e.g., a specific release version) to ensure reproducible builds, and update it through the automated tool version update workflow.

The manifest.yaml defines RUNNER_VERSION=latest but the update-tools.yaml workflow doesn't check for updates to the GitHub Actions runner version. Unlike the other tools (argo, kargo, pack, dive, hadolint, yq), there's no automated check or update mechanism for the runner base image version. Consider adding runner version checks to the update workflow to keep the base image up to date.