|
|
40736a41e1
|
infra: pin all compose file image digests
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 3s
sop-tier-check / tier-check (pull_request) Failing after 2s
Replace mutable tags (postgres:16-alpine, redis:7-alpine,
clickhouse/clickhouse-server:24-alpine, temporalio/auto-setup:1.25,
temporalio/ui:2.31.2, langfuse/langfuse:2, litellm:main-latest,
ollama:latest) with pinned SHA256 digests fetched from Docker Hub / GHCR.
Rationale: mutable image tags can silently resolve to a different image
over time, creating supply-chain risk. Digest-pinning ensures the
exact image content runs every time.
Refresh procedure documented in comments above each image line:
- Docker Hub: curl https://hub.docker.com/v2/repositories/<img>/tags/<tag>
- GHCR: curl -sI https://ghcr.io/v2/<owner>/<repo>/manifests/<tag>
Remaining: canvas ECR image (requires AWS credentials to fetch digest).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-05-10 12:06:10 +00:00 |
|
