{"repo":"azu/dockerfile-pin","free":true,"listed":false,"github":"https://github.com/azu/dockerfile-pin","clone":"git clone https://github.com/azu/dockerfile-pin.git","description":"A CLI tool for digest pinning — adds @sha256:<digest> to Dockerfile, docker-compose.yml, and GitHub Actions to prevent supply chain attacks.","language":"Go","stars":81,"topics":["docker","security","tools","github-actions"],"license":"MIT","category":"deployment-docker-iac","readme_excerpt":"dockerfile-pin A CLI tool that adds @sha256: to FROM lines in Dockerfiles, image fields in docker-compose.yml, and Docker image references in GitHub Actions files to prevent supply chain attacks. Install curl aqua Go See GitHub Releases for all platforms. Usage Run Add digests to Dockerfile FROM lines, docker-compose.yml image fields, and GitHub Actions Docker image references. By default, shows changes without modifying files (dry-run). Dockerfile Before: After: docker-compose.yml Before: After: GitHub Actions Before: After: Check Validate that digests are present and exist in the registry. Output: Exit code is 1 when any check fails (configurable with --exit-code ). Configuration File Create .dockerfile-pin.yaml (or .dockerfile-pin.yml ) in your project root to configure ignore rules: Config file patterns are merged with --ignore-images CLI flags. CLI flags are evaluated after config file patterns, so they take precedence (last match wins). Pattern Syntax Patterns use glob matching (doublestar syntax): Pattern Matches Does not match --------- --------- ---------------- scratch scratch scratch:latest node: node:20 , node:latest node:20@sha256:... ghcr.io/myorg/ ghcr.io/myorg/app:v1 ghcr.io/myorg/sub/app:v1 ghcr.io/myorg/ ghcr.io/myorg/app:v1 , ghcr.io/myorg/sub/app:v1 ghcr.io/other/app:v1 .dkr.ecr. .amazonaws.com/ 123.dkr.ecr.us-east-1.amazonaws.com/app:v1 Negation patterns (prefixed with ! ) override previous matches: Supported Patterns Dockerfiles Pattern Supported -------","default_branch":null,"files":null,"tree":[],"storefront":"/r/azu","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/azu/dockerfile-pin/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}