fix(supply-chain): verify CI and production inputs

Pin external actions, images, toolchains, native archives, and tvOS engine artifacts; enforce fail-closed CI checks and keep website privacy disclosures aligned with shipped behavior.
2026-07-24 03:56:40 +02:00
parent b41fb4fe75
commit 09656fa4d3
63 changed files with 5146 additions and 560 deletions
@@ -1,4 +1,6 @@
-FROM golang:1.22-alpine AS build
+# Update the readable tag, index digest, and platforms together using the controlled process in CONTRIBUTING.md.
+# Platforms: linux/amd64, linux/arm64
+FROM golang:1.22.12-alpine3.21@sha256:1699c10032ca2582ec89a24a1312d986a3f094aed3d5c1147b19880afe40e052 AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download