From 748563b1588c5c1699b14f0e87680773b30f2b95 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 22:00:14 +0000
Subject: [PATCH 1/3] Initial plan


From 1c68f065dd6fa4de6872228f4fdab691de3e1b4e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 22:08:17 +0000
Subject: [PATCH 2/3] Pin Docker base images

---
 Dockerfile         |  4 ++--
 dockerfile_test.go | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)
 create mode 100644 dockerfile_test.go

diff --git a/Dockerfile b/Dockerfile
index 24cc58e40..af70ef575 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.25-alpine AS builder
+FROM golang:1.25.11-alpine3.22@sha256:65b4400aee0927412e9ed791a11893273a49d55df24841f7599660fb80dae464 AS builder
 
 WORKDIR /app
 
@@ -17,7 +17,7 @@ ARG VERSION=dev
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.Version=${VERSION}" -o awmg .
 
 # Runtime stage
-FROM alpine:latest
+FROM alpine:3.22.5@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
 
 # Install Docker CLI and bash for launching backend MCP servers
 RUN apk add --no-cache docker-cli bash
diff --git a/dockerfile_test.go b/dockerfile_test.go
new file mode 100644
index 000000000..6be363898
--- /dev/null
+++ b/dockerfile_test.go
@@ -0,0 +1,33 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	expectedBuilderBase = "FROM golang:1.25.11-alpine3.22@sha256:65b4400aee0927412e9ed791a11893273a49d55df24841f7599660fb80dae464 AS builder"
+	expectedRuntimeBase = "FROM alpine:3.22.5@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce"
+)
+
+func TestDockerfileUsesPinnedBaseImages(t *testing.T) {
+	t.Parallel()
+
+	_, thisFile, _, ok := runtime.Caller(0)
+	require.True(t, ok, "runtime.Caller should resolve this test file path")
+
+	dockerfilePath := filepath.Join(filepath.Dir(thisFile), "Dockerfile")
+	content, err := os.ReadFile(dockerfilePath)
+	require.NoError(t, err)
+
+	dockerfile := string(content)
+	assert.Contains(t, dockerfile, expectedBuilderBase)
+	assert.Contains(t, dockerfile, expectedRuntimeBase)
+	assert.NotContains(t, dockerfile, "FROM golang:1.25-alpine AS builder")
+	assert.NotContains(t, dockerfile, "FROM alpine:latest")
+}

From 322a16dba35c4776c686c01368f395660d273821 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 22:16:28 +0000
Subject: [PATCH 3/3] Refine Dockerfile pinning regression test

---
 dockerfile_test.go | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/dockerfile_test.go b/dockerfile_test.go
index 6be363898..623ecfac2 100644
--- a/dockerfile_test.go
+++ b/dockerfile_test.go
@@ -3,6 +3,7 @@ package main
 import (
 	"os"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"testing"
 
@@ -10,9 +11,9 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-const (
-	expectedBuilderBase = "FROM golang:1.25.11-alpine3.22@sha256:65b4400aee0927412e9ed791a11893273a49d55df24841f7599660fb80dae464 AS builder"
-	expectedRuntimeBase = "FROM alpine:3.22.5@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce"
+var (
+	pinnedBuilderPattern = regexp.MustCompile(`(?m)^FROM golang:\d+\.\d+(?:\.\d+)?-alpine\d+\.\d+(?:\.\d+)?@sha256:[a-f0-9]{64} AS builder$`)
+	pinnedRuntimePattern = regexp.MustCompile(`(?m)^FROM alpine:\d+\.\d+(?:\.\d+)?@sha256:[a-f0-9]{64}$`)
 )
 
 func TestDockerfileUsesPinnedBaseImages(t *testing.T) {
@@ -26,8 +27,6 @@ func TestDockerfileUsesPinnedBaseImages(t *testing.T) {
 	require.NoError(t, err)
 
 	dockerfile := string(content)
-	assert.Contains(t, dockerfile, expectedBuilderBase)
-	assert.Contains(t, dockerfile, expectedRuntimeBase)
-	assert.NotContains(t, dockerfile, "FROM golang:1.25-alpine AS builder")
-	assert.NotContains(t, dockerfile, "FROM alpine:latest")
+	assert.Regexp(t, pinnedBuilderPattern, dockerfile)
+	assert.Regexp(t, pinnedRuntimePattern, dockerfile)
 }