From 9c945ba2ac731328ad1149e49fa0bd80098e672d Mon Sep 17 00:00:00 2001
From: Patrick Erichsen <patrick.a.erichsen@gmail.com>
Date: Tue, 27 Oct 2026 22:19:45 -0700
Subject: [PATCH] fix: pin runtime bases across verification and publication

---
 docker/clawscan-runtime/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker/clawscan-runtime/Dockerfile b/docker/clawscan-runtime/Dockerfile
index 70f3805..c354339 100644
--- a/docker/clawscan-runtime/Dockerfile
+++ b/docker/clawscan-runtime/Dockerfile
@@ -1,9 +1,9 @@
 ARG SHFMT_VERSION=v3.14.1
-FROM golang:1.27.3 AS bash-parser
+FROM golang:1.27.3@sha256:6f1acc898d064a4e9d5773ee574a9af6a9b786306939ac14d7fd806bf62046db AS bash-parser
 ARG SHFMT_VERSION
 RUN CGO_ENABLED=0 GOBIN=/out go install "mvdan.cc/sh/v3/cmd/shfmt@${SHFMT_VERSION}"
 
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f
 ARG SHFMT_VERSION
 
 ARG SKILLSPECTOR_REF=95a52d89fa16f608f0b18ccee76b0918ea4b7eef