{{ message }}
Repository navigation
sec: digest-pin Dockerfile.test base image (follow-up to #421) #1007
Description
Summary
Follow-up to #421 (which digest-pinned Dockerfile.dev). Dockerfile.test still uses the unpinned tag golang:1.25.4-alpine3.21 (Dockerfile.test:6) and carries the same "Pin to SHA256 digest" TODO (line 4). The same supply-chain risk #421 addressed for the dev image applies to the test image.
Acceptance criteria
- Pin
Dockerfile.testFROM to the samegolang:1.25.4-alpine3.21@sha256:3289aac...58b33digest already used by Dockerfile + Dockerfile.dev (keep the human-readable tag inline + a dated refresh comment). - Remove the stale TODO.
Activity
cristim commentedon Jul 27, 2026
Verification sweep against
main(101f099fb) on 2026-07-27 finds this already resolved.Dockerfile.test is digest-pinned to golang:1.26.5-alpine3.24, later bumped further.
Evidence: Dockerfile.test:7; follow-up bump a840ed1.
Recommending close.
cristim commentedon Sep 2, 2026
Verified resolved at 3c0f8ac: Dockerfile.test pins its base image by digest (golang:1.26.6-alpine3.24@sha256:3889b425...) and the stale TODO is removed. Evidence: Dockerfile.test:8 (first pinned in commit 877653d, kept aligned by a840ed1 and #1833). Residual axes checked: Dockerfile:18 and Dockerfile.dev:8 use the identical digest, so the three Go images are in lockstep. Closing as completed; reopen if the behaviour recurs.