Skip to content

build: pin base image digests #740

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
av1155 merged 2 commits into from
Aug 12, 2026
Merged

build: pin base image digests #740

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
edeb371
build: pin base image digests
av1155 Aug 12, 2026
bd1ed5f
Merge branch 'main' into build/pin-base-image-digests
av1155 Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@ updates:
interval: "weekly"
day: "monday"
open-pull-requests-limit: 5
# Let a freshly published version sit before proposing it, so a
# compromised release is more likely to be pulled first. Security
# updates are exempt from cooldown, so patches are not delayed.
cooldown:
default-days: 7
groups:
production-deps:
patterns:
Expand Down Expand Up @@ -36,6 +41,8 @@ updates:
interval: "weekly"
day: "monday"
open-pull-requests-limit: 5
cooldown:
default-days: 7
groups:
production-deps:
dependency-type: production
Expand All @@ -55,7 +62,24 @@ updates:
interval: "weekly"
day: "monday"
open-pull-requests-limit: 5
cooldown:
default-days: 7
groups:
github-actions:
patterns:
- "*"

# Dockerfile base images. Required: the FROM lines are digest-pinned, so
# without this the bases never pick up upstream security patches.
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
open-pull-requests-limit: 5
cooldown:
default-days: 7
groups:
docker-base-images:
patterns:
- "*"
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
# Compile Tailwind v4 + Houndarr custom CSS into a single static file. Node
# lives only in this stage; the final runtime image stays Python-only.
# -----------------------------------------------------------------------------
FROM node:22-alpine AS css-build
FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS css-build
WORKDIR /build

# Enable pnpm via corepack (bundled with Node 20+). The packageManager field
Expand All @@ -32,7 +32,7 @@ RUN pnpm run build-css
# -----------------------------------------------------------------------------
# Stage 2: runtime
# -----------------------------------------------------------------------------
FROM python:3.13-slim
FROM python:3.13-slim@sha256:ffb752e139c0a19692a43af8d8523b274222dd68eebad5d583b45c2201c6e30a

ARG HOUNDARR_VERSION=dev

Expand Down
Loading