[Project516]

What

• Pins every third-party uses: in .github/workflows to a full commit SHA with a # vX.Y.Z comment. Same major versions as before, newest release in each major.
• Pins the Dockerfile inputs: the emsdk base image to its multi-arch index digest, the dockerfile frontend (# syntax=) to docker/dockerfile:1.10@sha256:..., and every library to a commit (<LIB>_COMMIT next to each existing <LIB>_BRANCH version, which scripts/check-doc-versions.mjs still reads). The zimg and FFmpeg git clone steps check that the cloned tag resolves to the pinned commit, so the FFmpeg version string is unchanged.
• Adds the docker ecosystem to .github/dependabot.yml.

No library versions, build flags or other behavior change. x264 (4-cores) and lame (master) were branches; they are pinned to their current heads.

Why

A moved tag, branch or image can change what CI builds and publishes without any commit here. Backports the supply-chain part of upstream ffmpegwasm#958.

Updating a pin

• Actions: dependabot (github-actions was already in dependabot.yml) bumps SHA pins and the version comment.
• Dockerfile image and syntax digests: the new docker entry covers them.
• Library commits: edit <LIB>_BRANCH and <LIB>_COMMIT together. Resolve the commit with git ls-remote <url> refs/tags/<tag>^{}.

Not run locally

Raspberry Pi, so no Docker build. CI builds the cores. Workflow and dependabot YAML parse, and every uses: line is pinned (grep).

Noticed, not fixed

• All three workflows already had a top-level permissions: contents: read and job-level elevation where needed, so nothing changed there.
• The syntax line moves from dockerfile-upstream:master-labs to dockerfile:1.10, as upstream did. It relies on git ADD being stable in 1.10; CI will confirm.
• Dependabot cannot bump the library commits.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8c47b330-cd42-45b2-b8ca-e316ebbc317a

📥 Commits

Reviewing files that changed from the base of the PR and between 9f65e29 and 694f489.

📒 Files selected for processing (6)

• .github/dependabot.yml
• .github/workflows/CI.yml
• .github/workflows/release.yml
• .github/workflows/website.yml
• Dockerfile
• scripts/check-doc-versions.mjs

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[project516-review-bot]

This PR pins all GitHub Actions to commit SHAs with version comments, pins the Dockerfile syntax and base image to digests, and pins every third-party library source to a commit hash (with verification steps for zimg and FFmpeg). It also adds a docker ecosystem to dependabot for automatic digest updates. No library versions or build behavior change.

---

_{review-bot, model nvidia/nemotron-3-ultra-550b-a55b:free, verdict approve}

[project516-review-bot]

This PR pins all third-party GitHub Actions to commit SHAs, pins the Dockerfile base image and syntax to digests, and adds commit SHAs for every library source (keeping the existing branch/tags for documentation). Verification steps ensure zimg and FFmpeg clones match the pinned commits. Dependabot is extended to the docker ecosystem for image/syntax digest updates. The check-doc-versions script regex is updated to handle the new digest format. No behavior changes.

---

_{review-bot, model nvidia/nemotron-3-ultra-550b-a55b:free, verdict approve}