chore(deps): update alpine:3.22 docker digest to 4b7ce07

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
alpine	final	digest	56b31e2 -> 4b7ce07

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Pull Request Review - PR #361

Summary

This PR updates the Alpine Linux base image digest in ci/publish-binary.Dockerfile from sha256:56b31e2... to sha256:4b7ce07.... This is an automated dependency update from Renovate.

Review Findings

✅ Code Quality & Best Practices

• LGTM: The change follows the repository's established pattern for Docker image pinning
• The repository uses Renovate with custom managers (.github/renovate.json5) to automatically track and update Docker digests
• Pinning by digest (@sha256:...) is a security best practice that ensures reproducible builds
• The change maintains the Alpine 3.22 version tag while updating the digest

✅ Security Considerations

• Positive: Using digest-based image references prevents supply chain attacks by ensuring exact image content
• The update likely includes security patches from upstream Alpine
• The image is pulled from the official Alpine registry

⚠️ Potential Concerns

1. Version Consistency Across Dockerfiles

   • ci/publish-binary.Dockerfile uses alpine:3.22@sha256:4b7ce07... (this PR)
   • Dockerfile uses alpine:3.22.1@sha256:4bcff63...
   • Note: These are different patch versions (3.22 vs 3.22.1) which may lead to inconsistencies between environments

2. Limited Context

   • No test results or CI checks visible in the review to verify the image works correctly
   • The PR description doesn't detail what changed in the Alpine image

📋 Test Coverage

• The publish-binary target is only used in the CD pipeline (continuous-delivery.yml)
• It runs on release events, so this won't be tested until the next release
• Recommendation: Consider testing the publish-binary Docker build manually or in CI before merging

🎯 Performance

• No performance impact expected from a patch-level Alpine update
• Image size should remain approximately the same

Recommendations

1. Consider aligning Alpine versions: Update the main Dockerfile to use the same Alpine 3.22 base (without patch version) for consistency, or explicitly document why different versions are needed

2. CI verification: Since automerge is enabled, ensure the repository has adequate CI checks that build and test this Dockerfile before merging

Verdict

Approve with minor observations. The change itself is clean and follows best practices. The version inconsistency between Dockerfiles is worth addressing in a future PR but shouldn't block this security/maintenance update.