harden(docker): pin the image by hash — base digest + npm ci from a lockfile

[askalf]

Closes the three agent-actionable open code-scanning alerts. The fourth (#21, CII-Best-Practices) needs a bestpractices.dev registration, not a code change — left open.

Scorecard #25 — Dockerfile:11, containerImage not pinned by hash

FROM node:22-slim is a mutable tag. Pinned to the digest it resolves to today (sha256:6c74791e…, verified against the registry, matches the remediation tip).

Scorecard #26 — Dockerfile:23, npmCommand not pinned by hash

npm i -g @askalf/truecopy@0.9.0 @modelcontextprotocol/server-everything@2026.7.4 pins a label, not bytes — a version tag can be republished, and nothing in the transitive tree was pinned at all. The image now installs from a lockfile:

• new docker/package.json + docker/package-lock.json — the image's own dependency set, separate from truecopy's
• RUN npm ci --omit=dev — all 108 packages carry an integrity hash; the git-sourced redstamp dependency is pinned to an exact commit

A tool whose entire purpose is making agents pin their supply chain should not install its own unpinned.

Two consequences worth review attention:

1. The CLIs move from a global install to /app/node_modules/.bin. ENV PATH puts that first, which covers the build steps, the ENTRYPOINT, and the downstream server pin-everything.mjs spawns.
2. git transport. npm writes hosted-git resolved URLs as git+ssh:// whenever the lock is generated on a machine with a GitHub SSH remote, and there is no key in the build. git config url."https://github.com/".insteadOf ssh://git@github.com/ makes the transport irrelevant — the commit SHA is what pins the dependency — so regenerating the lock on another machine can't break the build later. (Same trap as ci(fuzz): root .dockerignore from #72 blanks ClusterFuzzLite's build context — scope it to the MCP image #76's ClusterFuzzLite build.)

Pinning by hash means nothing moves the pins on its own, so Dependabot now watches the base image (docker) and the image dependency set (/docker npm) alongside the existing entries.

Verification: npm ci --omit=dev re-run in a clean directory with an empty npm cache and GIT_SSH_COMMAND=false — resolves and installs 108 packages over HTTPS, truecopy / truecopy-mcp / mcp-server-everything all present in node_modules/.bin. The full image build + live MCP handshake is what docker.yml asserts on this PR (it triggers on Dockerfile, Dockerfile.dockerignore, docker/**), including the empty-tools/list regression and the non-root check.

CodeQL #27 — support/evidence.test.mjs:39, unused variable

mismatches was destructured and never used. Asserted rather than deleted: zero unverifiable hits on a real scan is the guarantee evidenceOf exists to make, and the integration test was the one place not checking it. 166 tests pass.

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer.

Verdict: No blocking issues found — clean, well-documented supply-chain hardening change. Approving.

What I checked

• gh pr diff 91 (1475 lines) — Dockerfile, Dockerfile.dockerignore, dependabot.yml, new docker/package.json + docker/package-lock.json, and the support/evidence.test.mjs assertion addition.
• CI check-rollup: all 10 checks green, including build-and-smoke (the docker workflow that actually builds the image, asserts non-root uid, and does a live stdio MCP handshake to confirm tools/list isn't empty — exactly the failure mode a lockfile/PATH change could cause).
• Cross-referenced docker/pin-everything.mjs and .github/workflows/docker.yml against the Dockerfile's new ENV PATH=/app/node_modules/.bin:$PATH (Dockerfile:38 in the new file) to confirm the local-bin CLIs (truecopy-mcp, mcp-server-everything) are actually resolvable at the point they're invoked (pin-everything.mjs, ENTRYPOINT) — they are, since the PATH change lands before both.
• Confirmed docker/package-lock.json records an integrity hash for every registry-resolved package and a pinned commit SHA (resolved: git+https://github.com/askalf/redstamp.git#3da60b9d...) for the git-sourced dependency, matching the PR's stated intent.
• .github/dependabot.yml diff adds ecosystems for both the new /docker npm manifest and the docker base image, consistent with the new pin points introduced.

What's good

• The base-image digest and npm lockfile close the two Scorecard hash-pinning alerts described in the PR body, and the CodeQL unused-variable fix is paired with an actual assertion (mismatches === 0) rather than just silencing the lint.
• The git config --global url."https://github.com/".insteadOf ssh://git@github.com/ line is a good catch — prevents a future lockfile regen on an SSH-configured machine from silently breaking the build.
• build-and-smoke CI directly exercises the two riskiest consequences of this change (root-owned-but-readable node_modules, and PATH resolution for the relocated CLIs) rather than just asserting the image builds.

No correctness, security, or test-coverage concerns in the diff. I did not find anything to request changes on.