From b562bda53dd69f25cb2ec7dd38083df284ce84e4 Mon Sep 17 00:00:00 2001
From: modem7 <modem7@gmail.com>
Date: Mon, 3 Aug 2026 10:53:47 +0100
Subject: [PATCH] ci(security): pin hadolint image by tag and digest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Using the mutable 'latest-alpine' tag let the linter image change
underneath CI without review — a supply-chain risk. Pin to
v2.15.1-alpine@sha256:a1d49... so the exact image is reproducible
and any change requires an explicit bump.
---
 .github/workflows/lint.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 6637287..d360468 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,5 +20,6 @@ jobs:
 
       - name: Run hadolint
         run: |
-          docker run --rm -v "$PWD":/work -w /work hadolint/hadolint:latest-alpine \
+          docker run --rm -v "$PWD":/work -w /work \
+            hadolint/hadolint:v2.15.1-alpine@sha256:a1d49ae1a4e83c1dbad26b8c1ad7588c8bd1e04f4866b34ad3cac50335198552 \
             sh -c "hadolint --version && hadolint Dockerfile"