After publishing a new CI image, docker-ci-image.yml now captures the
sha256 digest from docker/build-push-action and opens an auto-PR that
rewrites the image reference in the workflow consumers from the tag
form to the digest form.

Mirrors the existing auto-PR pattern from update-rnnoise.yml
(peter-evans/create-pull-request, branch deleted on close,
labels: ci). Permissions block extended from packages:write to also
include contents:write and pull-requests:write — the minimum the
create-pull-request action needs to push a branch and open the PR.

Consumer set covers ci.yml, codeql.yml, and sanitizers.yml. A `[ -f ]`
guard lets the loop run cleanly when a consumer file isn't on main
yet (sanitizers.yml until PR #2866 lands).

peter-evans/create-pull-request is pinned to commit SHA inline with
the rest of the third-party action references on main.

Idempotent both ways:
  - Bootstrap run on a ":latest" reference swaps in the digest.
  - Subsequent re-runs producing the same digest leave files untouched.
  - A re-run with a new digest cleanly replaces the previous one.

This PR adds the mechanism only — it does not modify ci.yml or
codeql.yml. After merge, one workflow_dispatch run produces the
bootstrap PR that lands the first pinned digest.

https://claude.ai/code/session_01PSLHgUjYZsq67v3Fz4peAE

…ork (#3155)

## Summary

The Sanitizers workflow ([first run
#26397650182](https://github.com/aethersdr/AetherSDR/actions/runs/26397650182),
2026-05-25 07:00 UTC) reported green — but it didn't actually run
anything under the sanitizers. The "Run tests under sanitizer" step
exited at code 2 on its very first line, before `ctest` ran.
\`continue-on-error: true\` silenced the failure at the job level, and
every downstream gate on \`steps.ctest.outputs.exit != '0'\` then
matched against an unset output, so the workflow walked through to
completion. Every scheduled run since the workflow landed (PR #2866,
2026-05-21) has produced a false-clean result with zero sanitizer
coverage.

## Root cause

The container image \`ghcr.io/ten9876/aethersdr-ci:latest\` defaults
\`/bin/sh\` to **Dash**, which doesn't understand \`set -o pipefail\` or
\`\${PIPESTATUS[0]}\`. Two bashisms, both at line 75/83 of
[`.github/workflows/sanitizers.yml`](.github/workflows/sanitizers.yml).

Run log signature:
```
/__w/_temp/...sh: 1: set: Illegal option -o pipefail
##[error]Process completed with exit code 2.
```

## Fix

One-line: add \`shell: bash\` to the "Run tests under sanitizer" step.
Bash is present in the container; only this step uses non-POSIX
features, so leaving the other steps on the default shell keeps the
patch minimal.

## Verification

Triggered \`workflow_dispatch\` on this branch: [run
#26415106480](https://github.com/aethersdr/AetherSDR/actions/runs/26415106480).
With the fix in place, the step should now reach \`ctest\` and either
pass cleanly or surface real sanitizer findings (and file/update the
sticky tracking issue). Result will appear there before this PR merges.

## Test plan

- [ ] Workflow dispatch run on this branch executes \`ctest\`
(verifiable in the step log)
- [ ] If tests pass under sanitizers: no behavior change vs. \"green\"
appearance, but now meaningful
- [ ] If tests fail: sticky issue gets opened or appended, artifacts
uploaded
- [ ] CI green on the PR itself

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…rsdr#2866)

…ork (aethersdr#3155)

## Summary

The Sanitizers workflow ([first run
#26397650182](https://github.com/aethersdr/AetherSDR/actions/runs/26397650182),
2026-05-25 07:00 UTC) reported green — but it didn't actually run
anything under the sanitizers. The "Run tests under sanitizer" step
exited at code 2 on its very first line, before `ctest` ran.
\`continue-on-error: true\` silenced the failure at the job level, and
every downstream gate on \`steps.ctest.outputs.exit != '0'\` then
matched against an unset output, so the workflow walked through to
completion. Every scheduled run since the workflow landed (PR aethersdr#2866,
2026-05-21) has produced a false-clean result with zero sanitizer
coverage.

## Root cause

The container image \`ghcr.io/ten9876/aethersdr-ci:latest\` defaults
\`/bin/sh\` to **Dash**, which doesn't understand \`set -o pipefail\` or
\`\${PIPESTATUS[0]}\`. Two bashisms, both at line 75/83 of
[`.github/workflows/sanitizers.yml`](.github/workflows/sanitizers.yml).

Run log signature:
```
/__w/_temp/...sh: 1: set: Illegal option -o pipefail
##[error]Process completed with exit code 2.
```

## Fix

One-line: add \`shell: bash\` to the "Run tests under sanitizer" step.
Bash is present in the container; only this step uses non-POSIX
features, so leaving the other steps on the default shell keeps the
patch minimal.

## Verification

Triggered \`workflow_dispatch\` on this branch: [run
#26415106480](https://github.com/aethersdr/AetherSDR/actions/runs/26415106480).
With the fix in place, the step should now reach \`ctest\` and either
pass cleanly or surface real sanitizer findings (and file/update the
sticky tracking issue). Result will appear there before this PR merges.

## Test plan

- [ ] Workflow dispatch run on this branch executes \`ctest\`
(verifiable in the step log)
- [ ] If tests pass under sanitizers: no behavior change vs. \"green\"
appearance, but now meaningful
- [ ] If tests fail: sticky issue gets opened or appended, artifacts
uploaded
- [ ] CI green on the PR itself

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>