Pin disposable PostgreSQL, MinIO, and Valkey smoke images by digest

[TheSilkky]

Pin disposable PostgreSQL, MinIO, and Valkey smoke images by digest

Priority

P2

Type

maintenance

Labels

Suggested GitHub labels:

• backlog
• dependencies
• docker
• testing
• maintenance

Branch scope

• Current branch: develop
• Current HEAD: 3555d1fd531ecd4b51b85779618bf4717514aa25
• Target branch: develop
• Original reviewed branch/ref: upgrade-codex-reports-and-repo-full-validation-security-review
• Original reviewed commit SHA: e609ff86028c81bd149839e03d1ffc0eb2ee9e4a
• Merged source pull request: #378
• Target release/version: unreleased
• Scope classification: release-blocker-current-branch
• Revalidation status: Revalidated against develop at 3555d1fd531ecd4b51b85779618bf4717514aa25 on 2026-07-12; repeat if develop moves before issue creation.

Summary

Pin every disposable PostgreSQL, MinIO server/client, and Valkey image used by release-validation Compose variants to an immutable digest.

Context

The release-validation Compose files select optional-backend services using mutable tags, including latest for MinIO images. A later rerun of the same reviewed source can therefore exercise different service bytes.

Issue #24 and PR #38 pinned production Docker base images. Issue #323 and PR #326 pinned the PostgreSQL GitHub Actions service. This draft is limited to the disposable services selected in compose/compose-full.yml, compose/compose-postgresql-local.yml, and compose/compose-sqlite-s3.yml.

Proposed change

Keep readable service tags but append reviewed manifest digests for PostgreSQL, MinIO server, MinIO client, and Valkey in every applicable smoke variant. Add or extend a documented dependency-refresh process so tags and digests are reviewed and updated together.

Acceptance criteria

• PostgreSQL, MinIO server, MinIO client, and Valkey images use explicit manifest digests in every applicable release smoke variant.
• No MinIO service uses latest without a digest.
• Tags remain readable alongside their matching digests.
• A documented command or dependency-automation path refreshes tags and digests together.
• The full, induced-retry, relay, and S3 deletion validation paths pass after pinning.
• Architecture and manifest selection are documented sufficiently for supported CI/local environments.
• No production credential, private endpoint, or provider-specific deployment detail is introduced.

Tests / validation

• Validate every affected Docker Compose configuration.
• Inspect each selected manifest digest with the established Docker tooling.
• Run the full optional-backend smoke test.
• Run the induced-retry full-stack smoke test.
• Run the relay smoke test.
• Run the disposable S3 deletion smoke test.
• Run scripts/check-markdown-links.py if docs change.
• Run git diff --check.
• Revalidate against the target branch before public issue creation.

Out of scope

• Reworking the production Dockerfiles or reopening completed base-image pinning.
• Changing application dependencies or supported backend semantics.
• Introducing a new container registry or cloud-provider deployment.
• Adding credentials, private endpoints, or production service configuration.
• Treating image pinning as proof of image trust or production readiness.

Notes

Report reference: docs/reports/2026-07-10-proofline-unreleased-technical-review.md, public finding F-012.

Related completed work: issue #24 and PR #38; issue #42 and PR #43; issue #323 and PR #326.

Open Docker base-image dependency updates are adjacent but do not cover these Compose smoke-service images.