Harden CICD image refs against empty SHA/base hash

.gitea/workflows/cicd.yaml

@@ -239,6 +239,21 @@ jobs:
           umask 077
           trap 'rm -f /tmp/ssh_key' EXIT
 
+          trim_spaces() {
+            printf '%s' "$1" | tr -d '[:space:]'
+          }
+
+          is_hex() {
+            value="$1"
+            if [ -z "${value}" ]; then
+              return 1
+            fi
+            case "${value}" in
+              (*[!0-9a-fA-F]*) return 1 ;;
+              (*) return 0 ;;
+            esac
+          }
+
           echo "=== Pre-build disk telemetry ==="
           df -h || true
           if command -v docker >/dev/null 2>&1; then
@@ -252,7 +267,25 @@ jobs:
 
           echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
 
-          BASE_HASH="${BASE_HASH_INPUT:-${BASE_HASH_FROM_BUILD}}"
+          RESOLVED_HEAD_SHA="$(trim_spaces "${HEAD_SHA:-}")"
+          if ! is_hex "${RESOLVED_HEAD_SHA}"; then
+            echo "❌ Invalid or empty HEAD_SHA resolved for build_cicd: '${HEAD_SHA:-}'"
+            exit 1
+          fi
+
+          BASE_HASH="$(trim_spaces "${BASE_HASH_INPUT:-${BASE_HASH_FROM_BUILD}}")"
+          if ! is_hex "${BASE_HASH}"; then
+            BASE_HASH="$(./scripts/compute-cicd-base-hash.sh | tr -d '[:space:]')"
+          fi
+
+          if ! is_hex "${BASE_HASH}"; then
+            echo "❌ Invalid or empty BASE_HASH resolved for build_cicd: '${BASE_HASH_INPUT:-${BASE_HASH_FROM_BUILD}}'"
+            exit 1
+          fi
+
+          echo "resolved_head_sha=${RESOLVED_HEAD_SHA}"
+          echo "resolved_base_hash=${BASE_HASH}"
+
           BASE_IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"
           docker pull "${BASE_IMAGE}"
 
@@ -262,14 +295,14 @@ jobs:
           docker build -f Dockerfile.cicd \
             --secret id=ssh_private_key,src=/tmp/ssh_key \
             --add-host "${GITEA_SSH_HOST}:${GITEA_REGISTRY_IP}" \
-            --build-arg GITHUB_SHA="${HEAD_SHA}" \
+            --build-arg GITHUB_SHA="${RESOLVED_HEAD_SHA}" \
             --build-arg CICD_BASE_IMAGE="${BASE_IMAGE}" \
             -t cicd:latest .
 
           docker tag cicd:latest "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:latest"
-          docker tag cicd:latest "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}"
+          docker tag cicd:latest "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${RESOLVED_HEAD_SHA}"
           docker push "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:latest"
-          docker push "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${HEAD_SHA}"
+          docker push "${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd:${RESOLVED_HEAD_SHA}"
 
       - *failure_diagnostics_step