Skip to content

Pin base image digests + auto-update via Renovate #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
BergCyrill wants to merge 2 commits into
base: main
Choose a base branch
from
+5 −5
Open

Pin base image digests + auto-update via Renovate #66

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a569035
build(docker): pin base image digests for reproducibility
BergCyrill May 12, 2026
dbd8f83
chore(renovate): enable docker:pinDigests preset to keep image digest…
BergCyrill May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM --platform=$BUILDPLATFORM golang:1.26.3 AS builder
FROM --platform=$BUILDPLATFORM golang:1.26.3@sha256:2981696eed011d747340d7252620932677929cce7d2d539602f56a8d7e9b660b AS builder

WORKDIR /workspace
RUN go env -w GOMODCACHE=/root/.cache/go-build
Expand All @@ -25,20 +25,20 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
--mount=type=cache,target=/go/pkg \
CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-s -w" -o bin/dependency-webhook ./cmd/webhook/

FROM gcr.io/distroless/static:nonroot AS controller
FROM gcr.io/distroless/static:nonroot@sha256:e3f945647ffb95b5839c07038d64f9811adf17308b9121d8a2b87b6a22a80a39 AS controller
WORKDIR /
COPY --from=controller-builder /workspace/bin/dependency-controller .
USER 65532:65532
ENTRYPOINT ["/dependency-controller"]

FROM gcr.io/distroless/static:nonroot AS webhook
FROM gcr.io/distroless/static:nonroot@sha256:e3f945647ffb95b5839c07038d64f9811adf17308b9121d8a2b87b6a22a80a39 AS webhook
WORKDIR /
COPY --from=webhook-builder /workspace/bin/dependency-webhook .
USER 65532:65532
ENTRYPOINT ["/dependency-webhook"]

# Combined image with both binaries (used by e2e tests and single-image deployments).
FROM gcr.io/distroless/static:nonroot
FROM gcr.io/distroless/static:nonroot@sha256:e3f945647ffb95b5839c07038d64f9811adf17308b9121d8a2b87b6a22a80a39
WORKDIR /
COPY --from=controller-builder /workspace/bin/dependency-controller .
COPY --from=webhook-builder /workspace/bin/dependency-webhook .
Expand Down
2 changes: 1 addition & 1 deletion renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
"extends": ["config:recommended", "helpers:pinGitHubActionDigests", "docker:pinDigests"],
"minimumReleaseAge": "1 day",
"osvVulnerabilityAlerts": true,
"vulnerabilityAlerts": {
Expand Down