deps: pin Docker base images with tag and digest - #2228
Merged
Quang Nguyen (nddq) merged 1 commit intoApr 21, 2026
Conversation
Every FROM line in the repository's Dockerfiles previously carried only a digest (`image@sha256:...`) and relied on an adjacent `# skopeo inspect ...` comment to document the intended tag. Dependabot does not read those comments — when a FROM line has no tag, it tracks the "latest" digest for the repository name and bumps blindly, regardless of which variant the digest actually corresponds to. This produced broken PRs. In #2220, for example, Dependabot replaced the Windows Server Core golang digest in Dockerfile.windows-cgo and Dockerfile.windows-native with the azurelinux3.0 digest used by the Linux images — the resulting FROM lines would not build. Per Dependabot's documentation, when both a tag and a digest are present on a FROM line, it only updates the digest within that tag. Switching all FROM lines to `image:tag@sha256:digest` gives Dependabot the context it needs to track each variant separately (azurelinux3.0, plain 1.26.2, windowsservercore-ltsc2022, etc.) and produces human-readable PR titles like "bump golang from 1.26.2-azurelinux3.0 to 1.27.0-azurelinux3.0" instead of "bump golang from \`33d887d\` to \`8fe67ba\`". While here, refresh each digest to the latest skopeo inspect result for its tag so Dependabot starts from a current baseline. The open Dependabot PRs (#2216–#2221) will be superseded and can be closed; subsequent runs will regenerate correctly-scoped PRs per tag. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Quang Nguyen (nddq)
requested review from
Alex Castilio (alexcastilio) and
Mathew Merrick (matmerr)
April 21, 2026 13:47
Retina Code Coverage ReportTotal coverage no change |
Quang Nguyen (nddq)
enabled auto-merge
April 21, 2026 14:16
ibezrukavyi
approved these changes
Apr 21, 2026
Quang Nguyen (nddq)
deleted the
deps/pin-docker-tags-and-refresh-digests
branch
April 21, 2026 21:54
Laksh (lakshk98)
pushed a commit
to lakshk98/retina
that referenced
this pull request
Aug 4, 2026
# Description Follow-up to microsoft#1885. Every `FROM` line in the repo's Dockerfiles pins only the digest (`image@sha256:...`) with the tag documented in an adjacent `# skopeo inspect` comment. Dependabot doesn't read the comments — with no tag on the `FROM`, it tracks the "latest" digest for the repository name and bumps blindly, ignoring which variant the pinned digest actually belongs to. This is already producing broken PRs. In microsoft#2220, the Windows Server Core `golang` digest in `controller/Dockerfile.windows-cgo` and `controller/Dockerfile.windows-native` was replaced with the `azurelinux3.0` digest used by the Linux images — those FROMs wouldn't build. ## Fix Per [Dependabot's docs](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file), when a `FROM` has both a tag and a digest, Dependabot only bumps the digest within that tag. Switching every `FROM` to `image:tag@sha256:digest` scopes each variant separately (`1.26.2-azurelinux3.0`, plain `1.26.2`, `1.26.2-windowsservercore-ltsc2022`, `windows/servercore:ltsc2022`, etc.) and yields readable PR titles like `bump golang from 1.26.2-azurelinux3.0 to 1.27.0-azurelinux3.0` instead of `` bump golang from `33d887d` to `8fe67ba` ``. While here, each digest is refreshed to the current `skopeo inspect` result for its tag. - **Scope**: 25 `FROM` lines across 14 Dockerfiles (`controller/`, `operator/`, `cli/`, `shell/`, `test/image/`, `hack/tools/{kapinger,toolbox}/`). - **Digest refresh**: 5 of 8 unique `image:tag` combinations had newer digests upstream; 3 (`azurelinux/base/core:3.0`, `azurelinux/distroless/minimal:3.0`, `mirror/docker/library/ubuntu:24.04`) were unchanged. - **Follow-up**: the 6 open Dependabot PRs microsoft#2216–microsoft#2221 should be closed; the next run will regenerate correctly-scoped PRs per tag. ## Related Issue Follow-up to microsoft#1885. No issue to close. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. - [ ] I have added tests, if applicable. ## Screenshots (if applicable) or Testing Completed N/A — config-only change. ## Additional Notes N/A. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Laksh (lakshk98)
pushed a commit
to lakshk98/retina
that referenced
this pull request
Aug 4, 2026
# Description Follow-up to microsoft#1885. Every `FROM` line in the repo's Dockerfiles pins only the digest (`image@sha256:...`) with the tag documented in an adjacent `# skopeo inspect` comment. Dependabot doesn't read the comments — with no tag on the `FROM`, it tracks the "latest" digest for the repository name and bumps blindly, ignoring which variant the pinned digest actually belongs to. This is already producing broken PRs. In microsoft#2220, the Windows Server Core `golang` digest in `controller/Dockerfile.windows-cgo` and `controller/Dockerfile.windows-native` was replaced with the `azurelinux3.0` digest used by the Linux images — those FROMs wouldn't build. ## Fix Per [Dependabot's docs](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file), when a `FROM` has both a tag and a digest, Dependabot only bumps the digest within that tag. Switching every `FROM` to `image:tag@sha256:digest` scopes each variant separately (`1.26.2-azurelinux3.0`, plain `1.26.2`, `1.26.2-windowsservercore-ltsc2022`, `windows/servercore:ltsc2022`, etc.) and yields readable PR titles like `bump golang from 1.26.2-azurelinux3.0 to 1.27.0-azurelinux3.0` instead of `` bump golang from `33d887d` to `8fe67ba` ``. While here, each digest is refreshed to the current `skopeo inspect` result for its tag. - **Scope**: 25 `FROM` lines across 14 Dockerfiles (`controller/`, `operator/`, `cli/`, `shell/`, `test/image/`, `hack/tools/{kapinger,toolbox}/`). - **Digest refresh**: 5 of 8 unique `image:tag` combinations had newer digests upstream; 3 (`azurelinux/base/core:3.0`, `azurelinux/distroless/minimal:3.0`, `mirror/docker/library/ubuntu:24.04`) were unchanged. - **Follow-up**: the 6 open Dependabot PRs microsoft#2216–microsoft#2221 should be closed; the next run will regenerate correctly-scoped PRs per tag. ## Related Issue Follow-up to microsoft#1885. No issue to close. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. - [ ] I have added tests, if applicable. ## Screenshots (if applicable) or Testing Completed N/A — config-only change. ## Additional Notes N/A. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #1885. Every
FROMline in the repo's Dockerfiles pins only the digest (image@sha256:...) with the tag documented in an adjacent# skopeo inspectcomment. Dependabot doesn't read the comments — with no tag on theFROM, it tracks the "latest" digest for the repository name and bumps blindly, ignoring which variant the pinned digest actually belongs to.This is already producing broken PRs. In #2220, the Windows Server Core
golangdigest incontroller/Dockerfile.windows-cgoandcontroller/Dockerfile.windows-nativewas replaced with theazurelinux3.0digest used by the Linux images — those FROMs wouldn't build.Fix
Per Dependabot's docs, when a
FROMhas both a tag and a digest, Dependabot only bumps the digest within that tag. Switching everyFROMtoimage:tag@sha256:digestscopes each variant separately (1.26.2-azurelinux3.0, plain1.26.2,1.26.2-windowsservercore-ltsc2022,windows/servercore:ltsc2022, etc.) and yields readable PR titles likebump golang from 1.26.2-azurelinux3.0 to 1.27.0-azurelinux3.0instead ofbump golang from `33d887d` to `8fe67ba`.While here, each digest is refreshed to the current
skopeo inspectresult for its tag.FROMlines across 14 Dockerfiles (controller/,operator/,cli/,shell/,test/image/,hack/tools/{kapinger,toolbox}/).image:tagcombinations had newer digests upstream; 3 (azurelinux/base/core:3.0,azurelinux/distroless/minimal:3.0,mirror/docker/library/ubuntu:24.04) were unchanged.33d887dto8fe67bain /operator #2216–deps: bump oss/go/microsoft/golang from8d219d3to8fe67bain /hack/tools/kapinger #2221 should be closed; the next run will regenerate correctly-scoped PRs per tag.Related Issue
Follow-up to #1885. No issue to close.
Checklist
git commit -S -s ...).Screenshots (if applicable) or Testing Completed
N/A — config-only change.
Additional Notes
N/A.