From 29b1b0d10d04ec9df8368dbbc92b425f343c5379 Mon Sep 17 00:00:00 2001
From: Lotem <81lotem@gmail.com>
Date: Wed, 1 Jul 2026 11:47:59 +0300
Subject: [PATCH 1/2] Pin the base image to a digest

python:3.13-alpine is a mutable tag that gets updated whenever
upstream ships Alpine/Python patches, so a build today could pull
different content than a build tomorrow with no change to this file.
Pin to the digest instead.
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 823a198..02bb8e7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.13-alpine
+FROM python:3.13-alpine@sha256:399babc8b49529dabfd9c922f2b5eea81d611e4512e3ed250d75bd2e7683f4b0
 
 COPY LICENSE \
         README.md \

From 8cec13c8cb5510d4e17be63044b783f2381170db Mon Sep 17 00:00:00 2001
From: Lotem <81lotem@gmail.com>
Date: Sat, 4 Jul 2026 11:09:56 +0300
Subject: [PATCH 2/2] Add dependabot config for Docker base image digest
 updates

Requested in review: since the Dockerfile now pins the base image by
digest, dependabot needs a docker-ecosystem entry to keep that digest
current.
---
 .github/dependabot.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fd83b11..e1b347e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,3 +8,10 @@ updates:
     directory: / # Check the repository's workflows under /.github/workflows/
     schedule:
       interval: daily
+
+  # Configure check for outdated base image digest in the Dockerfile.
+  # See: https://docs.docker.com/build/building/best-practices/#pin-base-image-versions
+  - package-ecosystem: docker
+    directory: / # Check the repository's Dockerfile at /Dockerfile
+    schedule:
+      interval: weekly