🤖 tests: pin the Bun 1.4.3 bug-bash sandbox image

[ThomasK33]

Summary

tests/bugbash/sandbox/image.json now pins the Bun 1.4.3 sandbox image that the "Bug-bash sandbox image" workflow published from main. This is step 3 of the image change from #6546 and #6547. After it merges, make bug-bash and make mcp-apps-e2e work on main again, and CI stops building the image locally.

Background

#6547 moved the sandbox image to Bun 1.4.3. That changed the inputs key to a4857a86…. Since then, main refuses model-driven runs with "stale image", and CI's sandbox job builds the image locally (#6546). A maintainer published the image from main in run 38579556750.

The record

Field	Value
digest	sha256:e292cecf2a92b3ff75e38cc18d934de115b9079a328effbcd328eb5461057da2
inputsKey	a4857a86e1f6eb70d9cc767a49b8cacdd11dbbfdb262e39a74e437ebccdd5da1, equal to build.sh --key on main
playwrightCore	1.63.0 (unchanged)
publishedFrom	460a5179f82ba80536b0b96257bafa75e973ab8c (main, after #6547 merged)

Validation

1. The digest comes from the build-provenance attestation of the publish run. The workflow does not print a separate record.
2. gh attestation verify oci://ghcr.io/coder/xum-bugbash-sandbox@sha256:e292cecf… --repo coder/xum passes. The signer is .github/workflows/bugbash-sandbox-image.yml@refs/heads/main, run 38579556750, source commit 460a5179f8.
3. I pulled the image by digest. Its org.xum.bugbash.inputs label is a4857a86…, and its org.xum.bugbash.playwright-core label is 1.63.0. Inside it, bun --version prints 1.4.3 and BUN_RUNTIME_TRANSPILER_CACHE_PATH is 0.
4. On this PR's CI, the sandbox job runs on the pinned digest. It must not print a LOCAL IMAGE warning.

Risks

Low. The change touches only this record. A wrong digest makes the runner refuse to start the sandbox (the label check), so it cannot run a wrong image silently.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $41.03

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T14:25:34.182135Z	e6c14ba	PR opened
🔒 Security Review	✅ Completed 2026-10-14T14:28:09.275246Z	e6c14ba	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.