From 21b35a4890a3444fa203e253f0c2396a63b1054d Mon Sep 17 00:00:00 2001
From: David Duran Rosich <git@daduraro.org>
Date: Sat, 24 Oct 2026 01:11:25 +0200
Subject: [PATCH] pin image

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 855da3a..c76b032 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1
 
 # Trivy is a single static binary, so it can be copied into a slim base image.
-ARG TRIVY_IMAGE=aquasec/trivy:latest
+ARG TRIVY_IMAGE=aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
 FROM ${TRIVY_IMAGE} AS trivy
 
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:a0f57064cbdcd6285fa45f51237ab0b35ea8ebaed06a1f5973e89e19dfb86704
 
 LABEL org.opencontainers.image.title="docker-vuln-scan" \
       org.opencontainers.image.description="Trivy image vulnerability scanner with Apprise alerts" \