Harden CI supply chain and base the image on Ubuntu 24.04

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+      include: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+      include: ["*"]

.github/workflows/build.yml

@@ -22,16 +22,16 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check startup.sh parses
         run: bash -n startup.sh
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Compute tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.IMAGE }}
           flavor: latest=false
@@ -42,16 +42,17 @@ jobs:
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
             type=edge,branch=main
             type=sha,prefix=main-,enable=${{ github.ref == 'refs/heads/main' }}
+            type=ref,event=pr
 
       - name: Log in to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64

Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 LABEL org.opencontainers.image.authors="Emre <e@emre.pm>"
 
 RUN \
@@ -13,6 +13,7 @@ ADD startup.sh /
 
 ENV \
   QEMU_BINARY=qemu-system-x86_64 \
+  MACHINE="" \
   RAM=2048 \
   SMP=1 \
   CPU=qemu64 \

startup.sh

@@ -25,6 +25,12 @@ if [ ! -d /data ]; then
   fi
 fi
 
+if [ -n "$MACHINE" ]; then
+  echo "[machine]"
+  FLAGS_MACHINE="-machine ${MACHINE}"
+  echo "parameter: ${FLAGS_MACHINE}"
+fi
+
 if [ -n "$ACCEL" ]; then
   echo "[accel]"
   FLAGS_ACCEL="-accel ${ACCEL}"
@@ -293,6 +299,7 @@ fi
 
 set -x
 exec ${QEMU_BINARY} \
+  ${FLAGS_MACHINE} \
   ${FLAGS_ACCEL} \
   ${FLAGS_CPU} \
   ${FLAGS_SMP} \