[kdumontnu]

Summary

• support an opt-in :ro marker on valid_volumes entries
• force matching short-form binds and long-form mounts read-only while preserving existing bind modifiers
• apply matching rules in configuration order with the last match winning
• preserve writable behavior for unmarked and internally appended runner-owned volume rules
• handle Windows drive-path binds using Docker-parsed source and target boundaries

Security impact

This prevents workflows from requesting writable access to operator-allowlisted shared paths that are intended to be read-only, reducing the risk of cross-workflow cache, configuration, and trust-store tampering. This remains defense in depth when workflow containers can access the Docker daemon socket.

Testing

• go test ./pkg/container -run "^(TestCheckVolumes|TestOptionsMountSurvivesSanitize)$" -count=1
• go vet ./pkg/container
• go build ./...
• regression coverage for Windows drive paths, bind modifiers, overlapping rules, runner-owned mounts, and long-form mounts

References Notion ticket ID-5346.