chore(security): pin Docker images by SHA digest by williaby · Pull Request #41 · ByronWilliamsCPA/audio-processor

williaby · 2026-05-26T17:47:39Z

Summary

Pin Docker base images by SHA digest to fix OpenSSF Scorecard Pinned-Dependencies findings.

python:3.12-slim -> @sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203 (all stages)
ghcr.io/astral-sh/uv:latest -> ghcr.io/astral-sh/uv:0.11.16@sha256:440fd6477af86a2f1b38080c539f1672cd22acb1b1a47e321dba5158ab08864d

Why

Same root cause as ByronWilliamsCPA/llc-manager#51. Floating tags break supply-chain integrity; immutable digests make the build deterministic and the Scorecard score climb by ~1.0-1.5.

How the SHAs were resolved

python:3.12-slim digest from Docker Hub tag API (last_updated 2026-05-22)
uv digest from GHCR OCI registry manifest; the 0.11.16 version tag added alongside digest so Renovate can auto-bump

Test plan

CI passes (no functional change)
Container security gate still satisfied
Next Scorecard run shows Pinned-Dependencies score increase

Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated Dockerfile to use digest-pinned base images for improved build reproducibility and consistency across environments.

@sha256

OpenSSF Scorecard Pinned-Dependencies check scored 0 because Docker images were pulled by floating tag. Pin to immutable SHA digests so the build is deterministic and resistant to upstream tag re-pointing. - python:3.12-slim -> @sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203 (Docker Hub digest as of 2026-05-22, applied to all stages) - ghcr.io/astral-sh/uv:latest -> ghcr.io/astral-sh/uv:0.11.16@sha256:440fd6477af86a2f1b38080c539f1672cd22acb1b1a47e321dba5158ab08864d (explicit version + digest so Renovate can auto-bump together) Same pattern as ByronWilliamsCPA/llc-manager#51. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

coderabbitai · 2026-05-26T17:47:50Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f16ed5c8-41cd-4ac1-bd78-5f8b0bb81845

📥 Commits

Reviewing files that changed from the base of the PR and between 1b1a036 and 936ba66.

📒 Files selected for processing (1)

Dockerfile

Walkthrough

The Dockerfile is updated to pin Python base images (python:3.12-slim) using sha256 digests for both builder and runtime stages, and replaces the floating uv:latest tag with a specific versioned image (uv:0.11.16) also pinned by digest. All other build logic remains unchanged.

Changes

Container Image Pinning

Layer / File(s)	Summary
Digest-pinned base and dependency images `Dockerfile`	Builder stage, runtime stage, and uv dependency tool image now reference sha256 digests instead of floating tags, improving build reproducibility and supply chain security.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

security

Poem

🐰 Three images pinned with SHA hashes so fine,
No more floating tags, just digests in line!
Builds reproducible, secure, and true,
The rabbit approves of this hardened brew. 📦✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore(security): pin Docker images by SHA digest' accurately and clearly summarizes the main change—pinning Docker images by SHA digest for improved reproducibility and security.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/sha-pin-docker-images

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-05-26T17:48:09Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copilot

Pull request overview

Pins Docker base images by immutable SHA256 digests to satisfy OpenSSF Scorecard “Pinned-Dependencies” guidance and improve supply-chain determinism for the project’s container build.

Changes:

Pin python:3.12-slim in both builder and runtime stages using a SHA256 digest.
Pin the ghcr.io/astral-sh/uv image used for COPY --from to a specific version + digest.

 # Stage 1: Builder - Install dependencies
 # =============================================================================
-FROM python:3.12-slim AS builder
+FROM python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203 AS builder


 # Stage 2: Runtime - Production image with audio processing capabilities
 # =============================================================================
-FROM python:3.12-slim AS runtime
+FROM python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203 AS runtime



 # Install UV for fast dependency management
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11.16@sha256:440fd6477af86a2f1b38080c539f1672cd22acb1b1a47e321dba5158ab08864d /uv /usr/local/bin/uv


…2026-139 (torch) (#44) * fix(security): resolve PYSEC-2026-161 (starlette) and suppress PYSEC-2026-139 (torch) Unblocks CI on PRs #39, #40, and #41. Both pip-audit and osv-scanner were flagging the same two CVEs, cascading into Code Quality, OSV Scanner, Security Gate, and CI Gate failures on every open PR. - Bump fastapi>=0.133.0 in [audio] extras and regenerate uv.lock; fastapi 0.136.3 + starlette 1.1.0 resolve PYSEC-2026-161. - Add PYSEC-2026-139 (torch/CVE-2026-4538) to osv-scanner.toml and [tool.pip-audit] ignore-vuln; no upstream fix exists. Torch is an optional [ml] extra absent from the production container. - Document PYSEC-2026-139 in docs/known-vulnerabilities.md per project CVE policy; reassess-by 2026-07-26. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: correct torch CVE suppression justification and compensating controls The PYSEC-2026-139 / CVE-2026-4538 suppression in three files contained two false claims: 1. "torch is never imported by the deployed service" - vad.py:16 has an unconditional top-level `import torch`, refuting the grep verification. 2. "not installed in the production container (which installs only the audio extra)" - the Dockerfile runs `uv sync --frozen --no-dev` with no --extra flags; no optional extras are installed at all. The compensating control (torch absent from production) remains valid. Update all three files to state the accurate mechanism: the Dockerfile installs no optional extras, so neither [ml] (direct) nor [audio] (transitive via silero-vad) entries for torch reach the runtime image. Remove the false grep verification claim from compensating controls. Also corrects: - Package field: adds the silero-vad transitive path in [audio] extra - Patched version row: shortened to fit 120-char Markdown line limit - pyproject.toml fastapi comment: "starlette<1.0.0" -> "starlette 0.x"; "starlette 1.x" -> "starlette>=1.1.0" (1.1.0 is the specific fix version) - osv-scanner.toml: replaces -- double-dash with comma (writing rule PC-011) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(changelog): add PYSEC-2026-161 and CVE-2026-4538 security entries Per CLAUDE.md CVE Citation Policy: any CHANGELOG entry that fixes a security vulnerability must include the CVE ID if one has been assigned. - PYSEC-2026-161 (starlette < 1.1.0): resolved by fastapi>=0.133.0 - CVE-2026-4538 / PYSEC-2026-139 (torch 2.9.1, AV:L HIGH): deferred with reassess-by 2026-07-26; no upstream fix available Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

sonarqubecloud · 2026-05-28T02:37:44Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot AI review requested due to automatic review settings May 26, 2026 17:47

Copilot started reviewing on behalf of williaby May 26, 2026 17:47 View session

coderabbitai Bot added the security label May 26, 2026

Copilot AI reviewed May 26, 2026

View reviewed changes

williaby mentioned this pull request May 27, 2026

fix(security): resolve PYSEC-2026-161 (starlette) and suppress PYSEC-2026-139 (torch) #44

Merged

2 tasks

williaby enabled auto-merge (squash) May 28, 2026 02:35

Merge branch 'main' into chore/sha-pin-docker-images

42d7e5a

williaby merged commit b2215ad into main May 28, 2026
33 of 35 checks passed

williaby deleted the chore/sha-pin-docker-images branch May 28, 2026 02:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(security): pin Docker images by SHA digest#41

chore(security): pin Docker images by SHA digest#41
williaby merged 2 commits into
mainfrom
chore/sha-pin-docker-images

williaby commented May 26, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 26, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

williaby commented May 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

How the SHAs were resolved

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested labels

Poem

Uh oh!

github-actions Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

sonarqubecloud Bot commented May 28, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

williaby commented May 26, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 26, 2026 •

edited

Loading

github-actions Bot commented May 26, 2026 •

edited

Loading