Pin CI base image by digest and rebuild weekly - #2477
Conversation
There was a problem hiding this comment.
Pull request overview
This PR makes the Docker base image build more reproducible and cache-stable by pinning the Ubuntu base image by digest, and adds automation to keep that pin and the cached layers fresh over time.
Changes:
- Pin
ubuntu:26.04indocker/Dockerfileusing an immutable digest to prevent upstream tag moves from invalidating caches unexpectedly. - Add a weekly scheduled run to rebuild the cached
base/base_rustDocker stages soapt-installed packages don’t drift stale between Dockerfile edits. - Introduce Dependabot configuration to track Docker dependency updates under
/docker.
Verdict: CORRECT
Generated with Claude Code
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| docker/Dockerfile | Switches Ubuntu base to a digest-pinned reference for reproducible builds and stable layer caching. |
| .github/workflows/docker-base.yaml | Adds a weekly cron trigger to refresh the cached Docker base stages. |
| .github/dependabot.yml | Enables weekly Dependabot checks for Docker updates in the docker/ directory. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Pin ubuntu:26.04 by digest, add dependabot to bump it when a new image is published, and rebuild the cached base image weekly.
48838b1 to
323071a
Compare
any idea how often this is? |
| # syntax=docker/dockerfile:1-labs | ||
|
|
||
| FROM ubuntu:26.04 AS base | ||
| FROM ubuntu:26.04@sha256:678c6550cc43645e08669028bc177f50be4e7c5b8cca677067b1914d4afc7a03 AS base |
There was a problem hiding this comment.
Should we do the same thing in other places we use bare 26.04 (e.g. monad-bft)?
There was a problem hiding this comment.
I'll get this on monad-bft
|
https://github.com/docker-library/official-images/commits/master/library/ubuntu Looks like about every 2 weeks |
Pins
ubuntu:26.04by digest so upstream tag pushes don't silently invalidate the shared build cache, adds a dependabot config to open a PR when a new image is published, and rebuilds the cached base image weekly so apt packages don't go stale between Dockerfile changes.