jethac opened a new issue, #42985: URL: https://github.com/apache/superset/issues/42985
### Problem Four service containers in `.github/workflows/` are referenced by mutable tag: ``` image: mysql:8.0 image: postgres:17-alpine image: redis:7-alpine image: starburstdata/presto:350-e.6 ``` A tag can be repointed at a different image without any change to this repository, so a CI run is not reproducible against its own history and a compromised or simply different upstream image lands silently. This is the same reasoning already applied to GitHub Actions, which are pinned to full commit SHAs here. ### Proposed change Pin each by digest (`image: postgres:17-alpine@sha256:...`), keeping the tag in the string for readability. Dependabot can keep digests current if `docker` is added to its ecosystem list. Verified against `master` at `3539c41dab`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
