From 0194c8f8cde3e5704453e2ebf4da1c38721bf2e5 Mon Sep 17 00:00:00 2001
From: LotemKahana <92536461+LotemKahana@users.noreply.github.com>
Date: Sat, 4 Jul 2026 14:53:16 +0300
Subject: [PATCH] Pin the base image to a digest (#99)

* Pin the base image to a digest

python:3.13-alpine is a mutable tag that gets updated whenever
upstream ships Alpine/Python patches, so a build today could pull
different content than a build tomorrow with no change to this file.
Pin to the digest instead.

* Add dependabot config for Docker base image digest updates

Requested in review: since the Dockerfile now pins the base image by
digest, dependabot needs a docker-ecosystem entry to keep that digest
current.
---
 .github/dependabot.yml | 7 +++++++
 Dockerfile             | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fd83b11..e1b347e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,3 +8,10 @@ updates:
     directory: / # Check the repository's workflows under /.github/workflows/
     schedule:
       interval: daily
+
+  # Configure check for outdated base image digest in the Dockerfile.
+  # See: https://docs.docker.com/build/building/best-practices/#pin-base-image-versions
+  - package-ecosystem: docker
+    directory: / # Check the repository's Dockerfile at /Dockerfile
+    schedule:
+      interval: weekly
diff --git a/Dockerfile b/Dockerfile
index a9df63a..554dc35 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.13-alpine
+FROM python:3.13-alpine@sha256:399babc8b49529dabfd9c922f2b5eea81d611e4512e3ed250d75bd2e7683f4b0
 
 COPY LICENSE \
         README.md \