Require a digest on every oci.pull
Open
@balajinvda is already working on this.
Since Jul 26, 2026.
ci
- Dominant language
- Go
- Stars
- 218
- Forks
- 72
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 427
Description
Description
Independent of #448.
Measured on main: 23 oci.pull declarations across 8 distinct images and 7 digests.
One pull uses a mutable tag rather than a digest:
public.ecr.aws/docker/library/eclipse-temurin
A tag-only pull is neither reproducible nor safe to cache, since the same Bazel
invocation can resolve to different bytes on different days.
Reproduce by reading the oci.pull declarations across tracked MODULE.bazel
files and checking which carry a digest attribute:
git ls-files | grep -E '(^|/)MODULE\.bazel$' | xargs grep -l 'oci\.pull'
Definition of Done
- Every
oci.pullcarries a digest. - A check rejects a new tag-only
oci.pull.
Resources
- #448
- #445
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.