Image and feature digest pinning syntax inconsistency

Bắt đầu bằng cách tái hiện vấn đề với hai định nghĩa feature trong một devcontainer.json và theo dõi đầu ra của Dev Container CLI về việc phân giải dependency của feature và xác thực đường dẫn. Được xem là hoàn thành khi một feature reference có thể giữ cả tag và digest một cách nhất quán với image references, đồng thời dạng digest-only hiện có vẫn tiếp tục hoạt động.

Hey,

I think the behavior of Dev Container CLI for digest pinning is inconsistent between the image field and feature keys. For images, it accepts the following definition without a problem:

mcr.microsoft.com/devcontainers/python:1.1.10-3.12-bookworm@sha256:c5b8bd1aa0c5c56c18de49024d2d67873612107c492ad0d8946c78c495e6ff0c

However, when it comes to feature keys, the following definition is not valid:

ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807

Feature keys require the following definition instead (which I've learned by digging into issues and finding #479 as I couldn't find any documentation on whether the features can be pinned), which omits the tag:

ghcr.io/devcontainers/features/aws-cli@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807

If you were to pin the feature with its tag, you get the following error:

@devcontainers/cli 0.60.0. Node.js v18.18.2. darwin 23.4.0 arm64.
Start: Run: docker buildx version
github.com/docker/buildx v0.13.1-desktop.1 2368b2ee41873b948cb607251cec573ed00f00f9
...
Resolving Feature dependencies for 'ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807'...
* Processing feature: ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807
Path 'devcontainers/features/aws-cli:1.0.7' for input 'ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807' failed validation.  Expected path to match regex '/^[a-z0-9]+([._-][a-z0-9]+)*(\/[a-z0-9]+([._-][a-z0-9]+)*)*$/'.
Could not resolve Feature manifest for 'ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807'.  If necessary, provide registry credentials with 'docker login <registry>'.

Not being able to use the tag of the image within definitions with digests makes the implementation of automatic dependency management harder (a Renovate discussion) and IMHO readability worse as you have no way of easily seeing which tag that feature is supposed to be. Would you consider changing this behavior?

Thanks! 🤗