From cd634aeb674dd2f289d7bf51edeec4bbe0efc765 Mon Sep 17 00:00:00 2001
From: Austin McKinley <austin@blueskyweb.xyz>
Date: Fri, 14 Aug 2026 21:06:03 -0700
Subject: [PATCH] Enable Docker base image updates

---
 .github/dependabot.yml                     | 19 ++++++++++++++++---
 .github/workflows/build-and-push-ghcr.yaml | 18 ++++++++++++------
 2 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9404af7..6573cdb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,13 +1,15 @@
 version: 2
 # Dependabot auto-update config.
 #
-# Cooldown (7 days) is the point of this config: it delays version-update
-# PRs until a newly-published version has aged. Supply-chain attacks like
+# npm and GitHub Actions use a 7-day cooldown so newly published versions age
+# before a PR opens. Supply-chain attacks like
 # the tanstack Shai-Hulud compromise (2026-05-11) live minutes-to-hours
 # before the registry yanks them; a 7-day cooldown keeps poisoned
 # versions out of our lockfiles.
 #
-# Security updates bypass cooldown and continue to flow immediately. See:
+# Security updates bypass cooldown and continue to flow immediately. Docker
+# uses a shorter 3-day operational-freshness policy and does not support
+# Dependabot security updates. See:
 # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown
 #
 # Auto-merge is deliberately NOT enabled. Every dependabot PR gets human
@@ -42,3 +44,14 @@ updates:
       actions:
         patterns: ["*"]
         update-types: [minor, patch]
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/Los_Angeles
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/build-and-push-ghcr.yaml b/.github/workflows/build-and-push-ghcr.yaml
index f2a5ce6..f51e37d 100644
--- a/.github/workflows/build-and-push-ghcr.yaml
+++ b/.github/workflows/build-and-push-ghcr.yaml
@@ -1,5 +1,9 @@
 name: build-and-push-ghcr
 on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - .github/workflows/build-and-push-ghcr.yaml
   push:
     branches:
       - main
@@ -15,7 +19,9 @@ env:
 
 jobs:
   ozone-container-ghcr:
-    if: github.repository == 'bluesky-social/ozone'
+    if: >-
+      github.repository == 'bluesky-social/ozone' ||
+      github.repository == 'bluesky-social/ozone-internal'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -24,13 +30,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME }}
@@ -38,7 +44,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -49,7 +55,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
-- 
knotmirror 0.0.1