From e3b517fe299a9862e569cb1d06d5b117e1c415f2 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Mon, 12 Oct 2026 22:29:02 +0200 Subject: [PATCH] test(complexity): pin the Dockerfile fixtures' base image by digest Scorecard's PinnedDependencies check opened code-scanning alerts #82-#84 on main for the complexity corpus's Dockerfile fixtures (added by #2597), and the CodeQL gate blocks on open alerts. The fixtures are indexer input and are never built; pinning them costs nothing and keeps the gate clean. Both FROM lines now name alpine:3.20 by its multi-arch index digest. The `FROM base` stage reference stays: it names the pinned first stage. complexity suite: 7 passed, fx_Dockerfile nodes 70 -> 139, edges 86 -> 173. Signed-off-by: Martin Vogel --- tests/fixtures/complexity/Dockerfile/Dockerfile | 2 +- tests/fixtures/complexity/Dockerfile/Dockerfile.worker | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/fixtures/complexity/Dockerfile/Dockerfile b/tests/fixtures/complexity/Dockerfile/Dockerfile index 985fd1488..43eede361 100644 --- a/tests/fixtures/complexity/Dockerfile/Dockerfile +++ b/tests/fixtures/complexity/Dockerfile/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.20 AS base +FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc AS base ENV TZ=UTC FROM base ENV APP_HOME=/app \ diff --git a/tests/fixtures/complexity/Dockerfile/Dockerfile.worker b/tests/fixtures/complexity/Dockerfile/Dockerfile.worker index 35c273d65..27b168aac 100644 --- a/tests/fixtures/complexity/Dockerfile/Dockerfile.worker +++ b/tests/fixtures/complexity/Dockerfile/Dockerfile.worker @@ -1,4 +1,4 @@ -FROM alpine:3.20 +FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc ENV APP_MODE=worker COPY run.sh /usr/local/bin/run.sh CMD ["/usr/local/bin/run.sh"]