Dashboard › publish › publish.yml Craft latest image

publish.yml Craft latest image

Category: gotcha

Confidence: 1.00

ID: 01a0867f-54eb-7960-a556-2a18f3a8b6e5

Project ID: ac098440-8723-4582-9021-39e07a608100

Cross-project: No

Recalled in other projects: 1

Source session: 1Qc6uYMGjA8JPChkR

Created: 2026-08-29 13:36:45

Updated: 2026-09-09 14:08:06

Cross-Project Recalls

Project	Hits	Last recalled
opencode-lore	2	15h ago

Content

Trap: docker://getsentry/craft:latest looks convenient, and rewriting the pinned image as ghcr.io/getsentry/craft@… looks like equivalent registry hardening, but latest is mutable and the GHCR image is unavailable. Fix: use the verified Docker Hub reference docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b; update it only through explicit review.