build: pin base image digests - #740
Merged
Merged
Conversation
A tag can be repointed at a different image by the publisher; a digest cannot. Both FROM lines now carry the multi-arch manifest list digest, so buildx still resolves the correct per-arch image. Adds the docker ecosystem to Dependabot in the same change: without it a digest pin would freeze the bases and stop upstream security patches, which is worse than the tag it replaces. Cooldown holds a newly published version for 7 days before it is proposed. Security updates are exempt, so patches are not delayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pins both Dockerfile base images to their manifest list digest, and adds the Dependabot coverage that keeps them current.
Closes #736
Changes
Dockerfile:node:22-alpineandpython:3.13-slimnow carry the multi-arch manifest list digest. The tag stays for readability and Dependabot tracking; buildx still resolves the correct per-arch image..github/dependabot.yml: add thedockerecosystem. This is required, not optional: a digest pin with nothing watching it freezes the bases and stops upstream security patches, which is worse than the mutable tag it replaces..github/dependabot.yml: addcooldown: default-days: 7to all four ecosystems. Security updates are exempt from cooldown, so patches are not delayed.Testing
Both digests verified to resolve against the registry.
hadolintclean. No Python touched and no test references the Dockerfile or Dependabot config.Type of Change
chore:) — commit is typedbuild:Checklist
Closes #Ntype:*and onepriority:*labelphase:*label (or none when not roadmap work)