## Changes
- **Dockerfile**: Pin `golang:1.25-alpine` and `alpine:3.19` base images to sha256 digests
- **Dockerfile**: Pin `golangci-lint` to `v2.10.1` and `goimports` to `v0.42.0` (was `@latest`)
- CI workflow actions were already pinned to commit SHAs — no changes needed
## `make check` output
All checks passed with zero failures.
Closes #118
sneak
was assigned by clawbot2026-02-20 19:45:17 +01:00
- Dockerfile: Pin golang and alpine base images to sha256 digests
- Dockerfile: Pin golangci-lint to v2.10.1 and goimports to v0.42.0
- CI workflows already pinned to commit SHAs (no changes needed)
Clean, focused PR that pins Docker base images to SHA256 digests and Go tool installs to specific versions in the Dockerfile. Only 1 file changed, 4 lines modified.
Checks
make check passes — all lints, tests, and build succeed with zero failures
No linter/test/CI config changes — .golangci.yml, Makefile, and .gitea/workflows/ are untouched
No regressions — identical test results to main
Changes Reviewed
Dockerfile:1 — golang:1.25-alpine pinned to golang@sha256:f6751d... with tag comment. GOOD.
Dockerfile:4 — golangci-lint@latest pinned to @v2.10.1. GOOD.
Dockerfile:5 — goimports@latest pinned to @v0.42.0. GOOD.
Dockerfile:23 — alpine:3.19 pinned to alpine@sha256:6baf43... with tag comment. GOOD.
Minor Observation (non-blocking)
The Go tool installs in the Dockerfile use semver tags (@v2.10.1, @v0.42.0) while the CI workflow uses commit SHAs. Both are acceptable since Go module proxy serves immutable checksum-verified content for version tags. Using commit SHAs in the Dockerfile too would be maximally consistent but is cosmetic.
Verdict: LGTM
PR achieves its stated goal cleanly. All external Docker image references use cryptographic digests. Go tool versions are pinned. No config weakening. Ready to merge.
## Code Review: PR #119
### Summary
Clean, focused PR that pins Docker base images to SHA256 digests and Go tool installs to specific versions in the Dockerfile. Only 1 file changed, 4 lines modified.
### Checks
- **make check passes** — all lints, tests, and build succeed with zero failures
- **No linter/test/CI config changes** — .golangci.yml, Makefile, and .gitea/workflows/ are untouched
- **No regressions** — identical test results to main
### Changes Reviewed
- Dockerfile:1 — golang:1.25-alpine pinned to golang@sha256:f6751d... with tag comment. GOOD.
- Dockerfile:4 — golangci-lint@latest pinned to @v2.10.1. GOOD.
- Dockerfile:5 — goimports@latest pinned to @v0.42.0. GOOD.
- Dockerfile:23 — alpine:3.19 pinned to alpine@sha256:6baf43... with tag comment. GOOD.
### Minor Observation (non-blocking)
The Go tool installs in the Dockerfile use semver tags (@v2.10.1, @v0.42.0) while the CI workflow uses commit SHAs. Both are acceptable since Go module proxy serves immutable checksum-verified content for version tags. Using commit SHAs in the Dockerfile too would be maximally consistent but is cosmetic.
### Verdict: LGTM
PR achieves its stated goal cleanly. All external Docker image references use cryptographic digests. Go tool versions are pinned. No config weakening. Ready to merge.
Updated: replaced version tags (@v2.10.1, @v0.42.0) with commit SHAs to match CI workflow and ensure true cryptographic pinning.
make check: ✅ All checks passed!
Reviewed the diff — all Docker FROM statements and go install commands in the repo now use cryptographic identity (sha256 digests / commit SHAs). The CI workflow was already correctly pinned.
Updated: replaced version tags (`@v2.10.1`, `@v0.42.0`) with commit SHAs to match CI workflow and ensure true cryptographic pinning.
`make check`: ✅ All checks passed!
Reviewed the diff — all Docker `FROM` statements and `go install` commands in the repo now use cryptographic identity (sha256 digests / commit SHAs). The CI workflow was already correctly pinned.
sneak
merged commit dc638a07f1 into main2026-02-23 20:48:09 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Changes
golang:1.25-alpineandalpine:3.19base images to sha256 digestsgolangci-linttov2.10.1andgoimportstov0.42.0(was@latest)make checkoutputAll checks passed with zero failures.
Closes #118
Pipeline sweep: PR is mergeable and CI checks passed. No code review yet — labeling
needs-review. Spawning review agent.Code Review: PR #119
Summary
Clean, focused PR that pins Docker base images to SHA256 digests and Go tool installs to specific versions in the Dockerfile. Only 1 file changed, 4 lines modified.
Checks
Changes Reviewed
Minor Observation (non-blocking)
The Go tool installs in the Dockerfile use semver tags (@v2.10.1, @v0.42.0) while the CI workflow uses commit SHAs. Both are acceptable since Go module proxy serves immutable checksum-verified content for version tags. Using commit SHAs in the Dockerfile too would be maximally consistent but is cosmetic.
Verdict: LGTM
PR achieves its stated goal cleanly. All external Docker image references use cryptographic digests. Go tool versions are pinned. No config weakening. Ready to merge.
e367c2dd5bto0ed2d02dfeUpdated: replaced version tags (
@v2.10.1,@v0.42.0) with commit SHAs to match CI workflow and ensure true cryptographic pinning.make check: ✅ All checks passed!Reviewed the diff — all Docker
FROMstatements andgo installcommands in the repo now use cryptographic identity (sha256 digests / commit SHAs). The CI workflow was already correctly pinned.