From 959ab8ee7af2fef67dfdc844d3c6e4a872e133ee Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Wed, 9 Sep 2026 15:46:27 -0700
Subject: [PATCH] build: pin Dockerfile base images by digest and drop the
 stale bcq test image

Dockerfile.test and docker-compose.test.yml still built ./cmd/bcq and set
BCQ_NO_KEYRING, neither of which has existed since the rename, so the
image could not build. Remove them rather than pin them.

Pin the remaining Dockerfile's golang and distroless images to their
current multi-arch digests and register the docker ecosystem with
Dependabot so the pins move with the tags instead of going stale.
---
 .github/dependabot.yml  | 18 ++++++++++++++++++
 Dockerfile              | 14 +++++---------
 Dockerfile.test         | 12 ------------
 docker-compose.test.yml | 10 ----------
 4 files changed, 23 insertions(+), 31 deletions(-)
 delete mode 100644 Dockerfile.test
 delete mode 100644 docker-compose.test.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1ff7a9a4e..9cb5425e6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -41,3 +41,21 @@ updates:
       default-days: 10
     commit-message:
       prefix: "ci"
+
+  # Container base images (digest pins in Dockerfile)
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: America/Chicago
+    open-pull-requests-limit: 10
+    groups:
+      docker:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 10
+    commit-message:
+      prefix: "build"
diff --git a/Dockerfile b/Dockerfile
index fbe50716c..6a6ee411d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,9 @@
 # Development Dockerfile for basecamp
 #
-# NOTE: This Dockerfile requires vendored dependencies or BuildKit secrets
-# for the private basecamp-sdk. For local builds, either:
-#   1. Run `go mod vendor` first, then build with: docker build .
-#   2. Use GoReleaser for release builds (handles auth automatically)
-#
-# For CI/release builds, use Dockerfile.goreleaser instead.
+# Local builds only: `docker build .` (vendor first with `go mod vendor` when
+# offline). Release binaries come from GoReleaser, not this image.
 
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS builder
 
 RUN apk add --no-cache git ca-certificates
 
@@ -20,7 +16,7 @@ ARG VERSION=dev
 ARG COMMIT=unknown
 ARG BUILD_DATE=unknown
 
-# Build with vendored deps if available, otherwise try to download (may fail without auth for private SDK)
+# Build with vendored deps if available, otherwise download
 RUN if [ -d vendor ]; then \
         CGO_ENABLED=0 GOOS=linux go build -mod=vendor \
             -trimpath \
@@ -35,7 +31,7 @@ RUN if [ -d vendor ]; then \
     fi
 
 # Runtime stage using distroless for minimal attack surface
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
 
 COPY --from=builder /basecamp /basecamp
 
diff --git a/Dockerfile.test b/Dockerfile.test
deleted file mode 100644
index 2421fdadf..000000000
--- a/Dockerfile.test
+++ /dev/null
@@ -1,12 +0,0 @@
-FROM golang:1.26-alpine
-
-RUN apk add --no-cache bash git jq
-RUN git clone https://github.com/bats-core/bats-core.git /tmp/bats && \
-    /tmp/bats/install.sh /usr/local
-
-WORKDIR /app
-COPY . .
-
-ENV BCQ_NO_KEYRING=1
-
-CMD ["sh", "-c", "go test ./... && go build -o bin/bcq ./cmd/bcq && BCQ_BIN=./bin/bcq bats e2e/"]
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
deleted file mode 100644
index b115d74de..000000000
--- a/docker-compose.test.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-version: '3.8'
-services:
-  test:
-    build:
-      context: .
-      dockerfile: Dockerfile.test
-    volumes:
-      - .:/app
-    environment:
-      - BASECAMP_NO_KEYRING=1