security: pin mitmproxy image chain + rtk installer (Phase 1 of #20) - #100

Merged

shejnowicz merged 13 commits into

security/20-pin-image-versions

Sep 2, 2026

Commits on Sep 2, 2026

docs(sdd): spec + plan for #20 image version pinning (Phase 1)

shejnowicz
and
claude
committed
ddb51e1
security(cli): pin mitmproxy image references to SCT_MITMPROXY_VERSION (#20)

shejnowicz
and
claude
committed
ad9be68
security(images): pin mitmproxy base via images/mitmproxy.env; cron rebuilds latest only (#20)
shejnowicz
committed
b200b66
fix(ci): restrict version tags to master refs in image workflows
shejnowicz
committed
009fb9a
security(rtk): pin install script to commit SHA (#20)

shejnowicz
and
claude
committed
e059913
docs: document pinned mitmproxy version + bump procedure

shejnowicz
and
claude
committed
6cb663a
fix(ci): run cli-tests on images/mitmproxy.env + grep -m1 in image workflows
shejnowicz
committed
01ccca6
security(rtk): pin binary via RTK_VERSION; correct stale-premise comment
shejnowicz
committed
874ccf8
docs: bump-procedure race note, image names, immutability wording
shejnowicz
committed
72ea668
chore: remove SDD spec + plan artifacts from branch
shejnowicz
committed
914196b
docs: move stray Cursor note under sandcat init devcontainer

shejnowicz
and
claude
committed
ac905e2
docs(images): explain why mitmproxy.env lives at the images/ level

shejnowicz
and
claude
committed
aba74fe
ci: simplify tag policy — latest is the newest pinned master build

shejnowicz
and
claude
committed
762ee63