use specific image digest when pulling base image

Author: marwan37

.github/workflows/build-push-codespace.yml

@@ -82,6 +82,13 @@ jobs:
             echo "exists=false" >> $GITHUB_OUTPUT
           fi
 
+      - name: Debug Docker image
+        if: steps.check.outputs.exists == 'true'
+        run: |
+          docker pull zenmldocker/zenml-sandbox:latest
+          docker image inspect zenmldocker/zenml-sandbox:latest || echo "Failed to inspect image"
+          docker manifest inspect zenmldocker/zenml-sandbox:latest || echo "Failed to inspect manifest"
+
       # ── Generate & submit PR if missing ─────────────────
       - name: Generate Dockerfile.codespace
         if: steps.check.outputs.exists == 'false'

omni-reader/Dockerfile.codespace

@@ -1,5 +1,5 @@
 # Sandbox base image
-FROM zenmldocker/zenml-sandbox:latest
+FROM zenmldocker/zenml-sandbox@sha256:bc9716318ac1441ab4887f5824979ac0653dcae54f667d5435d08b369d057e88
 
 # Install uv from official distroless image
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

oncoclear/Dockerfile.codespace

@@ -1,5 +1,5 @@
 # Sandbox base image
-FROM zenmldocker/zenml-sandbox:latest
+FROM zenmldocker/zenml-sandbox@sha256:bc9716318ac1441ab4887f5824979ac0653dcae54f667d5435d08b369d057e88
 
 # Install uv from official distroless image
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

scripts/generate_codespace_dockerfile.py

@@ -11,7 +11,7 @@
 
 # Dockerfile template
 DOCKER_TEMPLATE = """# Sandbox base image
-FROM zenmldocker/zenml-sandbox:latest
+FROM zenmldocker/zenml-sandbox@sha256:bc9716318ac1441ab4887f5824979ac0653dcae54f667d5435d08b369d057e88
 
 # Install uv from official distroless image
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/