From a932a1cd025ca819d7aca6a5b5482f21a49c9ad9 Mon Sep 17 00:00:00 2001 From: "Ioannis L." <44038245+blitzcrieg1@users.noreply.github.com> Date: Thu, 5 Nov 2026 23:06:13 +0200 Subject: [PATCH] ci: pin the recorder image's base images by digest The Dockerfile named node:20-alpine and python:3.12-slim by tag, and a tag can be moved to other content after the fact. Those were the only two container dependencies in the repo, and OpenSSF Scorecard's Pinned-Dependencies check counted 0 of 2 pinned. The workflows have pinned their actions by SHA for this reason already; the image had been missed. A digest that never moves also stops receiving the base image's security fixes, so Dependabot now watches the Dockerfile. It is told to ignore minor and major version updates, because which Node and Python the image runs is a decision, and CI tests 3.12. The fingerprint is unchanged. The image was not built: no CI job builds it and this machine has no Docker. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 19 +++++++++++++++++++ apps/orchestrator/Dockerfile | 7 +++++-- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d9136635..e986f757 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -55,6 +55,25 @@ updates: patterns: ["*"] update-types: ["minor", "patch"] + # --- The recorder image ---------------------------------------------------- + # The Dockerfile pins its base images by digest. Without this entry those pins + # rot, and a digest that never moves stops receiving the base image's security + # fixes. Digest bumps only: which Node and Python the image runs is a decision, + # not a Monday PR, and 3.12 is what CI tests. + - package-ecosystem: docker + directory: /apps/orchestrator + schedule: + interval: weekly + day: monday + time: "07:00" + timezone: Europe/Athens + labels: ["dependencies"] + commit-message: + prefix: "deps" + ignore: + - dependency-name: "*" + update-types: ["version-update:semver-major", "version-update:semver-minor"] + # --- The workflows themselves -------------------------------------------- # A pinned action is a dependency with code execution in a job that holds an # OIDC token good enough to publish to PyPI. This is the highest-value diff --git a/apps/orchestrator/Dockerfile b/apps/orchestrator/Dockerfile index f6907e97..a4de9839 100644 --- a/apps/orchestrator/Dockerfile +++ b/apps/orchestrator/Dockerfile @@ -6,8 +6,11 @@ # It used to start `uvicorn api.main:app`, a module path that has not existed # since the package became `agentmetry`, so the image could not boot. It also # installed gcc and libpq for a Postgres the recorder no longer uses. +# +# Base images are pinned by digest, because a tag can be moved to other content +# after the fact. Dependabot bumps the digests. -FROM node:20-alpine AS dashboard +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS dashboard WORKDIR /dashboard COPY apps/dashboard/package.json apps/dashboard/package-lock.json ./ RUN npm ci @@ -17,7 +20,7 @@ COPY apps/dashboard/ ./ ENV NEXT_PUBLIC_SAME_ORIGIN=true RUN npm run build -FROM python:3.12-slim +FROM python:3.12-slim@sha256:4840d514c583a4d3d8cad3940e68dee6f0f6f3635c12fcd0a3d74c21a5b93a54 WORKDIR /app COPY apps/orchestrator/ ./