@dockerforge/cli 0.2.1 → 0.2.2

package/README.md

@@ -42,6 +42,7 @@ dockerforge generate .                 # write files into the current directory
 dockerforge generate ./app -o ./out    # write into a chosen directory
 dockerforge generate . --print         # print the Dockerfile, write nothing
 dockerforge generate . --json          # JSON output for scripts and CI
+dockerforge generate . --pin-digests   # resolve Docker Hub base images to sha256 digests
 ```
 
 | Flag | Effect |
@@ -49,6 +50,7 @@ dockerforge generate . --json          # JSON output for scripts and CI
 | `-o, --output <dir>` | Write output to this directory. Defaults to the target path. |
 | `--print` | Print the Dockerfile to stdout instead of writing files. |
 | `--json` | Print `{ dockerfile, dockerignore, compose, confidence, improvements }`. |
+| `--pin-digests` | Resolve Docker Hub base-image tags to immutable SHA-256 digests. Makes live registry requests. |
 | `--stack <name>` | Override stack detection (`node`, `python`, `dotnet`, ...). |
 | `--port <n>` | Set the exposed port. |
 | `--no-optimise` | Skip the optimisation pass. |
@@ -58,6 +60,11 @@ The default output is a coloured summary with the detected services, a confidenc
 warnings. `--json` and `--print` produce plain output with no decoration. Colour turns off when
 the output is not a terminal or when `NO_COLOR` is set.
 
+Default generation is offline. `--pin-digests` is opt-in because it contacts Docker Hub to turn
+base-image tags such as `node:20-alpine3.21` into `node:20-alpine3.21@sha256:...`. Digest-pinned
+images stay fixed until you update them, so pair this with Docker Scout, Renovate, Dependabot, or
+another digest refresh process.
+
 After reviewing the generated files, build and run with Docker:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dockerforge/cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "DockerForge CLI: generate production-grade Dockerfiles, .dockerignore, and Compose from a local project, and lint Dockerfiles (human/JSON/SARIF). Offline.",
   "license": "Apache-2.0",
   "author": "Docker Forge",
@@ -44,7 +44,7 @@
     "sarif"
   ],
   "dependencies": {
-    "@dockerforge/core": "0.2.1",
+    "@dockerforge/core": "0.2.2",
     "commander": "^13.1.0"
   }
 }

package/src/index.js

@@ -46,6 +46,7 @@ program
   .option('--no-security', 'Skip security pass')
   .option('--stack <stack>', 'Hint the stack (node, python, dotnet, ...)')
   .option('--port <port>', 'Hint the exposed port', (v) => parseInt(v, 10))
+  .option('--pin-digests', 'Resolve Docker Hub base-image tags to immutable sha256 digests (network)')
   .option('--json', 'Output JSON {dockerfile, dockerignore, compose, confidence, improvements}')
   .action(async (targetPath, opts) => {
     try {
@@ -61,6 +62,14 @@ program
         hints,
         optimise: opts.optimise,
         security: opts.security,
+        pinDigests: opts.pinDigests,
+        digestResolver: process.env.DOCKERFORGE_TEST_DIGEST
+          ? async (imageRef) => ({
+            original: imageRef,
+            pinned: `${imageRef}@${process.env.DOCKERFORGE_TEST_DIGEST}`,
+            digest: process.env.DOCKERFORGE_TEST_DIGEST,
+          })
+          : undefined,
       });
 
       // --- machine output: keep byte-identical shape to the old CLI for CI use ---