ci: harden pinned supply chain dependencies (issue #56)

.github/workflows/ci.yml

@@ -120,14 +120,14 @@ jobs:
 
       - name: Upload runtime SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@v4.34.1
+        uses: github/codeql-action/upload-sarif@cb06a0a8527b2c6970741b3a0baa15231dc74a4c  # v4.34.1
         with:
           sarif_file: artifacts/security/trivy-runtime.sarif
           category: trivy-runtime
 
       - name: Upload CLI SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@v4.34.1
+        uses: github/codeql-action/upload-sarif@cb06a0a8527b2c6970741b3a0baa15231dc74a4c  # v4.34.1
         with:
           sarif_file: artifacts/security/trivy-cli.sarif
           category: trivy-cli

docker/Dockerfile

@@ -1,4 +1,5 @@
-FROM openresty/openresty:1.29.2.1-jammy
+FROM openresty/openresty:1.25.3.2-jammy@sha256:698244e2730c5496b2c828d1f91a5cd864a2983fb3fa3b497025fddadc014a9b
+
 
 RUN apt-get update && apt-get upgrade -y --no-install-recommends \
   && apt-get install -y --no-install-recommends \
@@ -8,7 +9,7 @@ RUN apt-get update && apt-get upgrade -y --no-install-recommends \
   mmdb-bin \
   && rm -rf /var/lib/apt/lists/*
 
-RUN opm get anjia0532/lua-resty-maxminddb
+RUN opm get anjia0532/lua-resty-maxminddb=1.3.7
 
 WORKDIR /opt/fairvisor
 

docker/Dockerfile.cli

@@ -1,4 +1,5 @@
-FROM openresty/openresty:1.29.2.1-jammy
+FROM openresty/openresty:1.25.3.2-jammy@sha256:698244e2730c5496b2c828d1f91a5cd864a2983fb3fa3b497025fddadc014a9b
+
 
 RUN apt-get update && apt-get upgrade -y --no-install-recommends \
   && apt-get install -y --no-install-recommends \

docker/Dockerfile.test

@@ -1,4 +1,5 @@
-FROM ubuntu:24.04
+FROM ubuntu:22.04@sha256:c9672795a48854502d9dc0f1b719ac36dd99259a2f8ce425904a5cb4ae0d60d2
+
 
 ENV DEBIAN_FRONTEND=noninteractive
 

spec/unit/supply_chain_pins_spec.lua

@@ -0,0 +1,42 @@
+package.path = "./spec/?.lua;./spec/?/init.lua;" .. package.path
+
+local function read_file(path)
+  local file = assert(io.open(path, "r"))
+  local contents = file:read("*a")
+  file:close()
+  return contents
+end
+
+describe("supply chain pinning", function()
+  local runtime_dockerfile
+  local cli_dockerfile
+  local ci_workflow
+
+  setup(function()
+    runtime_dockerfile = read_file("docker/Dockerfile")
+    cli_dockerfile = read_file("docker/Dockerfile.cli")
+    ci_workflow = read_file(".github/workflows/ci.yml")
+  end)
+
+  it("pins the OpenResty base image digest in runtime and CLI Dockerfiles", function()
+    local expected = "openresty/openresty:1.25.3.2%-jammy@sha256:698244e2730c5496b2c828d1f91a5cd864a2983fb3fa3b497025fddadc014a9b"
+
+    assert.is_truthy(runtime_dockerfile:match(expected))
+    assert.is_truthy(cli_dockerfile:match(expected))
+  end)
+
+  it("pins lua-resty-maxminddb to a concrete OPM version", function()
+    assert.is_truthy(runtime_dockerfile:match("RUN opm get anjia0532/lua%-resty%-maxminddb=1%.3%.7"))
+    assert.is_falsy(runtime_dockerfile:match("RUN opm get anjia0532/lua%-resty%-maxminddb%s*$"))
+  end)
+
+  it("pins both CodeQL upload-sarif actions to the resolved commit SHA", function()
+    local _, count = ci_workflow:gsub(
+      "github/codeql%-action/upload%-sarif@cb06a0a8527b2c6970741b3a0baa15231dc74a4c",
+      ""
+    )
+
+    assert.equals(2, count)
+    assert.is_falsy(ci_workflow:match("github/codeql%-action/upload%-sarif@v4%.34%.1"))
+  end)
+end)