From 06c66d8df83a7393cd111c4908d1016e9e99ce39 Mon Sep 17 00:00:00 2001
From: "MUH. IQRAM BAHRING" <MUHIQRAMBAHRING@GMAIL.COM>
Date: Sat, 5 Sep 2026 23:55:33 +0800
Subject: [PATCH] ci(docker): pin node:22-alpine by digest so npm cannot drift
 under npm ci

---
 Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index b949f8f1..5094ed2f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,7 @@
 # syntax=docker/dockerfile:1.7
-ARG NODE_IMAGE=node:22-alpine
+# Pinned by digest so a base-image refresh cannot silently bump npm and break
+# `npm ci` against the committed lockfile (see v1.0.9 npm ci EUSAGE failure).
+ARG NODE_IMAGE=node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32
 FROM ${NODE_IMAGE} AS base
 WORKDIR /app