openclaw - 💡(How to fix) Fix Docker: Automate base image digest updates and add stale image alerts [1 participants]

ARG OPENCLAW_NODE_BOOKWORM_IMAGE="node:24-bookworm@sha256:3a09aa6354567619221ef6c45a5051b671f953f0a1924d1f819ffb236e520e6b"
ARG OPENCLAW_NODE_BOOKWORM_SLIM_IMAGE="node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb"

# .github/dependabot.yml (existing)
- package-ecosystem: docker
  directory: /
  schedule:
    interval: weekly
  groups:
    docker-images:
      patterns:
        - "*"
  open-pull-requests-limit: 5

- package-ecosystem: docker
  directory: /
  schedule:
    interval: weekly
  ignore:
    - dependency-name: "node"
      update-types: ["version-update:semver-major"]  # Only update patch/minor via digest

name: Check Docker Base Image Age
on:
  schedule:
    - cron: '0 9 * * 1'  # Weekly on Monday
  workflow_dispatch:

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Extract current digest
        id: current
        run: |
          DIGEST=$(grep "OPENCLAW_NODE_BOOKWORM_DIGEST" Dockerfile | head -1 | cut -d'" -f2)
          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
      
      - name: Check image age
        run: |
          # Query Docker Hub API for image creation date
          # Alert if >30 days old
          echo "Checking age of ${{ steps.current.outputs.digest }}"
          # ... implementation
      
      - name: Create issue if stale
        if: steps.check.outputs.days_old > 30
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: 'Docker base image is >30 days old',
              body: `Current digest: ${{ steps.current.outputs.digest }}\nConsider updating to latest.`,
              labels: ['docker', 'maintenance']
            });

## Updating Base Images

To update the Node.js base image:

1. Check for newer digests:
   ```bash
   docker buildx imagetools inspect node:24-bookworm

## Acceptance Criteria

- [ ] Verify Dependabot proposes digest updates for Docker
- [ ] Weekly CI job checks base image age
- [ ] Alert created when image >30 days old
- [ ] Documentation added for manual update process
- [ ] Update runbook in `docs/development/docker.md`

## References

- Current Dockerfile: `Dockerfile:10-15`
- Dependabot config: `.github/dependabot.yml:87-96`
- Docker image: `node:24-bookworm`

---

**Priority:** Medium
**Effort:** Low (1 day)
**Labels:** docker, security, automation