Pin and update docker shas

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"

Dockerfile

@@ -1,10 +1,16 @@
 # syntax=docker/dockerfile:1.10
 # enable docker linting
 # check=error=true
-ARG UBUNTU_VERSION=ubuntu:20.04
-# we are parameterizing the base image, so we can't be explicit like DL3006 wants us to be
-# hadolint ignore=DL3006
-FROM $UBUNTU_VERSION as base-docker
+
+# this must come before FROM lines
+ARG UBUNTU_VERSION=ubuntu-20.04
+
+# Include each version with sha so that dependabot can update them
+FROM ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214 AS ubuntu-20.04
+FROM ubuntu:22.04@sha256:c7eb020043d8fc2ae0793fb35a37bff1cf33f156d4d4b12ccc7f3ef8706c38b1 AS ubuntu-22.04
+FROM ubuntu:24.04@sha256:cd1dba651b3080c3686ecf4e3c4220f026b521fb76978881737d24f200828b2b AS ubuntu-24.04
+
+FROM $UBUNTU_VERSION AS base-docker
 
 # default env vars
 ENV container=docker DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 LC_ALL=C.UTF-8

Justfile

@@ -51,17 +51,7 @@ test: build
   docker run $RUN_ARGS --rm -v {{justfile_directory()}}:/tests -w /tests $ACTION_IMAGE_NAME:24.04 ./tests.sh
   ./check.sh
 
-# Update the files tracking the SHAs of ubuntu docker image
-update-docker-shas:
-  @just _update-sha "ubuntu:20.04"
-  @just _update-sha "ubuntu:22.04"
-
-_update-sha os:
-  echo {{ os }}
-  docker image pull {{ os }}
-  docker inspect --format='{{{{index .RepoDigests 0}}' {{ os }} > {{ os }}.sha
-
-
+# publish the images to ghcr.io
 publish-images:
   #!/bin/bash
   set -euo pipefail

docker-compose.yaml

@@ -20,44 +20,44 @@ services:
     image: "base-docker:20.04"
     build:
       args:
-        - UBUNTU_VERSION=ubuntu:20.04
+        - UBUNTU_VERSION=ubuntu-20.04
 
   base-docker-22.04:
     extends: base-docker
     image: "base-docker:22.04"
     build:
       args:
-        - UBUNTU_VERSION=ubuntu:22.04
+        - UBUNTU_VERSION=ubuntu-22.04
 
   base-docker-24.04:
     extends: base-docker
     image: "base-docker:24.04"
     build:
       args:
-        - UBUNTU_VERSION=ubuntu:24.04
+        - UBUNTU_VERSION=ubuntu-24.04
 
   base-action-20.04:
     extends: base-docker
     image: "base-action:20.04"
     build:
       args:
-        - UBUNTU_VERSION=ubuntu:20.04
+        - UBUNTU_VERSION=ubuntu-20.04
       target: base-action
 
   base-action-22.04:
     extends: base-docker
     image: "base-action:22.04"
     build:
       args:
-        - UBUNTU_VERSION=ubuntu:22.04
+        - UBUNTU_VERSION=ubuntu-22.04
       target: base-action
 
   base-action-24.04:
     extends: base-docker
     image: "base-action:24.04"
     build:
       args:
-        - UBUNTU_VERSION=ubuntu:24.04
+        - UBUNTU_VERSION=ubuntu-24.04
       target: base-action
 
 secrets: