Skip to content

ci: pin the recorder image's base images by digest #384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
blitzcrieg1 merged 1 commit into from
Nov 5, 2026
+24 −2
Merged

ci: pin the recorder image's base images by digest #384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,25 @@ updates:
patterns: ["*"]
update-types: ["minor", "patch"]

# --- The recorder image ----------------------------------------------------
# The Dockerfile pins its base images by digest. Without this entry those pins
# rot, and a digest that never moves stops receiving the base image's security
# fixes. Digest bumps only: which Node and Python the image runs is a decision,
# not a Monday PR, and 3.12 is what CI tests.
- package-ecosystem: docker
directory: /apps/orchestrator
schedule:
interval: weekly
day: monday
time: "07:00"
timezone: Europe/Athens
labels: ["dependencies"]
commit-message:
prefix: "deps"
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major", "version-update:semver-minor"]

# --- The workflows themselves --------------------------------------------
# A pinned action is a dependency with code execution in a job that holds an
# OIDC token good enough to publish to PyPI. This is the highest-value
Expand Down
7 changes: 5 additions & 2 deletions apps/orchestrator/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,11 @@
# It used to start `uvicorn api.main:app`, a module path that has not existed
# since the package became `agentmetry`, so the image could not boot. It also
# installed gcc and libpq for a Postgres the recorder no longer uses.
#
# Base images are pinned by digest, because a tag can be moved to other content
# after the fact. Dependabot bumps the digests.

FROM node:20-alpine AS dashboard
FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS dashboard
WORKDIR /dashboard
COPY apps/dashboard/package.json apps/dashboard/package-lock.json ./
RUN npm ci
Expand All @@ -17,7 +20,7 @@ COPY apps/dashboard/ ./
ENV NEXT_PUBLIC_SAME_ORIGIN=true
RUN npm run build

FROM python:3.12-slim
FROM python:3.12-slim@sha256:4840d514c583a4d3d8cad3940e68dee6f0f6f3635c12fcd0a3d74c21a5b93a54
WORKDIR /app

COPY apps/orchestrator/ ./
Expand Down
Loading