Pin Dockerfile base images by digest and drop the stale bcq test image - #691
Pin Dockerfile base images by digest and drop the stale bcq test image#691jeremy wants to merge 1 commit into
Conversation
…st image Dockerfile.test and docker-compose.test.yml still built ./cmd/bcq and set BCQ_NO_KEYRING, neither of which has existed since the rename, so the image could not build. Remove them rather than pin them. Pin the remaining Dockerfile's golang and distroless images to their current multi-arch digests and register the docker ecosystem with Dependabot so the pins move with the tags instead of going stale.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟢 Approval recommended
The pins are valid multi-platform references, obsolete files have no remaining consumers, and Dependabot supports the added configuration.
Pull request overview
Pins Docker base images, removes obsolete test-container files, and configures Dependabot to maintain image digests.
Changes:
- Pin builder and runtime images by digest.
- Remove stale
bcqDocker test setup. - Add weekly Docker dependency updates.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
Dockerfile |
Pins base images and updates stale guidance. |
Dockerfile.test |
Removes the obsolete test image. |
docker-compose.test.yml |
Removes the test image’s sole consumer. |
.github/dependabot.yml |
Adds Docker digest maintenance. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Closes out the Scorecard PinnedDependencies alerts that point at Dockerfiles. The other open Scorecard alerts were triaged separately (dismissals with reasons, one card for the branch-protection/code-review policy decision); this PR only carries the code changes.
Alerts
Dockerfile:10(golang:1.26-alpine)sha256:ce864e72…Dockerfile:38(distroless/static-debian12:nonroot)sha256:afa5c872…Dockerfile.test:1./cmd/bcqand setBCQ_NO_KEYRING; neither exists since the rename, so the image could not build. Deleted along withdocker-compose.test.yml, its only consumer.Digests were resolved from the registries directly (Docker Hub and gcr.io manifest-list
Docker-Content-Digest) and match Scorecard's suggested pins.Keeping the pins fresh
Digest pins go stale unless something moves them, so
.github/dependabot.ymlgains adockerecosystem entry mirroring the existing gomod/actions cadence (weekly, grouped, 10-day cooldown). Dependabot rewritesimage:tag@sha256:…lines when the tag advances.The Dockerfile header also loses two stale claims: it pointed at a
Dockerfile.goreleaserthat does not exist (.goreleaser.yamlhas nodockers:stanza) and described the SDK as private.Verification
docker build .on the pinned Dockerfile succeeds;docker run --rm <image> versionprintsbasecamp version dev (built from source).make check: fmt-check, vet, lint, lint-actions, test-e2e, check-naming, check-surface, check-skill-drift, check-bare-groups, check-lint-lockstep, check-smoke-coverage, provenance-check, tidy-check all pass.make testshows only the known TTY-gated failures (TestIsInteractive*,TestInteractive*,TestIsTerminal,TestDeleteConfirmable…,TestBareBasecamp…,TestExplicitSetup…), which do not touch this diff (no Go changes).govulncheck ./...andgovulncheck -tags dev ./...: no reachable vulnerabilities.Summary by cubic
Pins both Dockerfile base images by digest to close Scorecard PinnedDependencies alerts, and deletes the stale
Dockerfile.test/docker-compose.test.ymlthat referenced removedcmd/bcqandBCQ_NO_KEYRING.dockerecosystem entry so digest pins stay fresh with tag updates.Dockerfile.goreleaserand a private SDK.Written for commit 959ab8e. Summary will update on new commits.