From edeb3717b1f715e5bd95278f90f696d7ff4f5c6d Mon Sep 17 00:00:00 2001
From: Andrea Arturo Venti Fuentes <117413846+av1155@users.noreply.github.com>
Date: Tue, 11 Aug 2026 20:05:35 -0400
Subject: [PATCH] build: pin base image digests

A tag can be repointed at a different image by the publisher; a digest
cannot. Both FROM lines now carry the multi-arch manifest list digest,
so buildx still resolves the correct per-arch image.

Adds the docker ecosystem to Dependabot in the same change: without it
a digest pin would freeze the bases and stop upstream security
patches, which is worse than the tag it replaces.

Cooldown holds a newly published version for 7 days before it is
proposed. Security updates are exempt, so patches are not delayed.
---
 .github/dependabot.yml | 24 ++++++++++++++++++++++++
 Dockerfile             |  4 ++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f911d1e2..8159e83e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,11 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    # Let a freshly published version sit before proposing it, so a
+    # compromised release is more likely to be pulled first. Security
+    # updates are exempt from cooldown, so patches are not delayed.
+    cooldown:
+      default-days: 7
     groups:
       production-deps:
         patterns:
@@ -36,6 +41,8 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     groups:
       production-deps:
         dependency-type: production
@@ -55,7 +62,24 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
         patterns:
           - "*"
+
+  # Dockerfile base images. Required: the FROM lines are digest-pinned, so
+  # without this the bases never pick up upstream security patches.
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    groups:
+      docker-base-images:
+        patterns:
+          - "*"
diff --git a/Dockerfile b/Dockerfile
index 3a8db1ca..b567d104 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@
 # Compile Tailwind v4 + Houndarr custom CSS into a single static file. Node
 # lives only in this stage; the final runtime image stays Python-only.
 # -----------------------------------------------------------------------------
-FROM node:22-alpine AS css-build
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS css-build
 WORKDIR /build
 
 # Enable pnpm via corepack (bundled with Node 20+). The packageManager field
@@ -32,7 +32,7 @@ RUN pnpm run build-css
 # -----------------------------------------------------------------------------
 # Stage 2: runtime
 # -----------------------------------------------------------------------------
-FROM python:3.13-slim
+FROM python:3.13-slim@sha256:ffb752e139c0a19692a43af8d8523b274222dd68eebad5d583b45c2201c6e30a
 
 ARG HOUNDARR_VERSION=dev