chore: update dependency management and add guardrail checks

.dockerignore

@@ -12,4 +12,4 @@ docs/
 .cov/
 .venv
 Dockerfile
-.env
+.env

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
     allow:
       - dependency-name: "*"
         dependency-type: "direct"
+    cooldown:
+      default-days: 14
     groups:
       all-dependencies:
         patterns:
@@ -21,18 +23,39 @@ updates:
     allow:
       - dependency-name: "*"
         dependency-type: "direct"
+    cooldown:
+      default-days: 14
     groups:
       all-dependencies:
         patterns:
           - "*"
 
-  - package-ecosystem: docker-compose
+  - package-ecosystem: "docker"
+    directories:
+      - "/"
+      - "/tests"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 14
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+        group-by: dependency-name
+
+  - package-ecosystem: "docker-compose"
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 14
     ignore:
-    - dependency-name: "*"
-      update-types: ["version-update:semver-major"]
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
     groups:
       all-dependencies:
         patterns:

.github/workflows/pr.yml

@@ -38,15 +38,50 @@ jobs:
       - name: Run typecheck
         run: |
           make typecheck
+  guardrail-check:
+    name: "Guardrail checks"
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            **/pyproject.toml
+            **/uv.lock
+      - name: Restore cache
+        id: cache-venv
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: .venv
+          key: venv-${{ runner.os }}-${{ hashFiles('**/pyproject.toml', '**/uv.lock') }}
+          restore-keys: |
+            venv-${{ runner.os }}-
+      - name: Install dependencies
+        if: steps.cache-venv.outputs.cache-hit != 'true'
+        run: |
+          uv sync --frozen --no-install-project
+      - name: Run guardrail checks
+        run: |
+          make test_guardrail_check
   unit-test:
     name: "Unit tests"
     runs-on: ubuntu-latest
     needs: build
     strategy:
       fail-fast: true
       matrix:
-        db: [postgres, mysql]
-        test_target: ["tests/app/", "tests/batch/"]
+        include:
+          - db: postgres
+            test_target: "tests/app/"
+          - db: mysql
+            test_target: "tests/app/"
+          - db: postgres
+            test_target: "tests/batch/"
+          - db: mysql
+            test_target: "tests/batch/"
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Dockerfile

@@ -1,10 +1,10 @@
-FROM ubuntu:24.04 AS builder
+FROM ghcr.io/astral-sh/uv:0.9.16@sha256:ae9ff79d095a61faf534a882ad6378e8159d2ce322691153d68d2afac7422840 AS uv
+
+FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b AS builder
 
 ENV PYTHON_VERSION=3.14.2
-ENV UV_VERSION=0.9.16
 ENV UV_COMPILE_BYTECODE=1
 ENV UV_LINK_MODE=copy
-ENV UV_INSTALL_DIR="/usr/local/bin"
 ENV UV_PROJECT_ENVIRONMENT="/home/apl/.venv"
 
 # make application directory
@@ -34,8 +34,7 @@ RUN apt-get update -q \
  && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 # install uv
-ADD https://astral.sh/uv/$UV_VERSION/install.sh /uv-installer.sh
-RUN INSTALLER_NO_MODIFY_PATH=1 sh /uv-installer.sh && rm /uv-installer.sh
+COPY --from=uv /uv /uvx /usr/local/bin/
 
 # install Python
 RUN uv python install $PYTHON_VERSION
@@ -66,7 +65,7 @@ RUN cd /app/ibet-Wallet-API \
  && rm -f /app/ibet-Wallet-API/uv.lock \
  && rm -rf /app/ibet-Wallet-API/tests/
 
-FROM ubuntu:24.04 AS runner
+FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b AS runner
 
 # make application directory
 RUN mkdir -p /app

Makefile

@@ -1,4 +1,4 @@
-.PHONY: format lint typecheck doc test test_migrations run
+.PHONY: format lint typecheck doc test test_guardrail_check test_guardrail test_migrations run
 
 install:
 	uv sync --frozen --no-install-project --all-extras
@@ -22,6 +22,11 @@ doc:
 test:
 	uv run pytest tests/ ${ARG}
 
+test_guardrail_check:
+	uv run pytest --override-ini addopts='' --noconftest -v -m "guardrail_check" tests/test_guardrail_check.py
+
+test_guardrail: test_guardrail_check
+
 test_migrations:
 	uv run pytest -vv --test-alembic -m "alembic"
 

README.md

@@ -59,6 +59,12 @@ Install python packages with:
 $ uv sync --frozen --no-install-project --no-dev
 ```
 
+### Dependency update policy
+
+- Dependabot manages `uv`, GitHub Actions, Dockerfile, and Docker Compose updates in this repository.
+- Regular version updates are delayed by a 14-day cooldown to reduce supply-chain risk. Security updates are still handled without that delay.
+- Docker base images and external Compose images are pinned by digest, and Dockerfiles must not rely on remote `ADD` or pipe-to-shell installers.
+
 ### Setting environment variables
 
 See the following documentation for environment variables that can be set in this system.

README_JA.md

@@ -60,6 +60,12 @@ $ uv venv
 $ uv sync --frozen --no-install-project --no-dev
 ```
 
+### 依存関係の更新ポリシー
+
+- このリポジトリでは `uv`、GitHub Actions、Dockerfile、Docker Compose の更新を Dependabot で管理します。
+- 通常のバージョン更新には 14 日の cooldown を設定し、サプライチェーンリスクを下げます。セキュリティ更新はこの遅延の対象外です。
+- Docker の base image と Compose で参照する外部 image は digest で固定し、Dockerfile ではリモート `ADD` や pipe-to-shell installer を使いません。
+
 ### 環境変数の設定
 
 設定可能な環境変数については以下のドキュメントを確認してください。

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   postgres:
-    image: postgres:17
+    image: postgres:17.10@sha256:0027bef26712baaee437a4ea48fdf3d2d2e2bc5f0d81615374408ca320f3c7e3
     ports:
       - "5432:5432"
     environment:
@@ -10,7 +10,7 @@ services:
     tmpfs:
       - /var/lib/postgresql/data
   mysql:
-    image: mysql:8.4
+    image: mysql:8.4.9@sha256:c36050afdca850f23cef85703f84c7531a5ae155a11b5ee1c60acb09937c4084
     environment:
       - MYSQL_USER=apluser
       - MYSQL_PASSWORD=apluserpass
@@ -74,4 +74,4 @@ services:
       - mysql
       - anvil-network
     volumes:
-      - ./cov:/app/ibet-Wallet-API/cov
+      - ./cov:/app/ibet-Wallet-API/cov

pyproject.toml

@@ -101,8 +101,11 @@ exclude = ["migrations/*", ".venv/*", "cov/*"]
 combine-as-imports = true
 
 [tool.pytest.ini_options]
-addopts = "-m 'not alembic'"
-markers = ["alembic: tests for alembic"]
+addopts = "-m 'not alembic and not guardrail_check'"
+markers = [
+    "alembic: tests for alembic",
+    "guardrail_check: tests for repository guardrails",
+]
 asyncio_default_fixture_loop_scope = "session"
 
 [tool.coverage.run]

tests/Dockerfile_anvil

@@ -1,7 +1,7 @@
-FROM ghcr.io/foundry-rs/foundry:latest
+FROM ghcr.io/foundry-rs/foundry:latest@sha256:8347b728d5d393dac1c018691b36f506d23b9dcd78341d40ea0fcb11c3a19cdd
 
 WORKDIR /app/ibet-Wallet-API
 
 COPY tests/run_anvil.sh /app/ibet-Wallet-API/tests/run_anvil.sh
 
-ENTRYPOINT ["bash", "/app/ibet-Wallet-API/tests/run_anvil.sh"]
+ENTRYPOINT ["bash", "/app/ibet-Wallet-API/tests/run_anvil.sh"]

tests/Dockerfile_unittest

@@ -1,10 +1,10 @@
-FROM ubuntu:24.04 AS builder
+FROM ghcr.io/astral-sh/uv:0.9.16@sha256:ae9ff79d095a61faf534a882ad6378e8159d2ce322691153d68d2afac7422840 AS uv
+
+FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b AS builder
 
 ENV PYTHON_VERSION=3.14.2
-ENV UV_VERSION=0.9.16
 ENV UV_COMPILE_BYTECODE=1
 ENV UV_LINK_MODE=copy
-ENV UV_INSTALL_DIR="/usr/local/bin"
 ENV UV_PROJECT_ENVIRONMENT="/home/apl/.venv"
 
 # make application directory
@@ -34,8 +34,7 @@ RUN apt-get update -q \
  && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 # install uv
-ADD https://astral.sh/uv/$UV_VERSION/install.sh /uv-installer.sh
-RUN INSTALLER_NO_MODIFY_PATH=1 sh /uv-installer.sh && rm /uv-installer.sh
+COPY --from=uv /uv /uvx /usr/local/bin/
 
 # install Python
 RUN uv python install $PYTHON_VERSION
@@ -63,7 +62,7 @@ RUN cd /app/ibet-Wallet-API \
  && rm -rf "$PYTHON_ROOT"/lib/python*/site-packages/pip "$PYTHON_ROOT"/lib/python*/site-packages/pip-*.dist-info \
  && rm -rf /home/apl/.cache/uv
 
-FROM ubuntu:24.04 AS runner
+FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b AS runner
 
 # make application directory
 RUN mkdir -p /app