chore: pin new Docker and fuzz dependencies by digest

[seonghobae]

Summary

• pin the new Docker and ClusterFuzzLite base images by digest so Scorecard no longer flags them as mutable container dependencies
• switch the new ClusterFuzzLite build path from ad hoc pip install calls to the existing uv.lock flow via locked fuzz and nvidia extras
• keep the lean image and fuzz smoke path reproducible while preserving the Apple Silicon/NVIDIA split introduced in the prior PRs

Verification

• uv run pytest tests/test_docker_delivery.py tests/test_fuzzing_integration.py tests/test_project_metadata.py -q
• uv run pytest tests/test_workflow_security.py tests/test_workflow_runtime_env.py -q
• uv run pytest -q
• PYTHONWARNINGS=error uv run pytest -q
• uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100 -q
• uv run mkdocs build --strict
• python3 -m py_compile fuzzers/dom_builder_fuzzer.py
• ./.venv/bin/python fuzzers/dom_builder_fuzzer.py --smoke tests/fixtures/mineru_sample.json
• podman build --format docker -t newsdom-api:test /tmp/newsdom-docker-context && podman run --rm -d --name newsdom-api-qa -p 18000:8000 localhost/newsdom-api:test && curl -sf http://127.0.0.1:18000/health

Summary by CodeRabbit

릴리스 노트

• Chores

  • 이미지 베이스와 도구 참조를 다이제스트로 고정하여 빌드 재현성 강화
  • 빌드 환경에 툴 바이너리를 직접 포함하고 빌드 스크립트를 이미지 내 지정 위치로 배치
  • 패키지 설치를 uv 기반 흐름으로 전환하고 pyproject에 선택적 fuzz 의존성 그룹 추가
  • CI 워크플로우에 GitHub 토큰 입력 추가

• Tests

  • 도커/퍼징 관련 통합 및 정적 검사 테스트 확장(고정 이미지·빌드 스텝 검증)

[coderabbitai]

📝 Walkthrough

Walkthrough

여러 Dockerfile과 ClusterFuzzLite 빌드 스크립트에서 베이스 이미지와 uv 도구를 SHA256 다이제스트로 고정하고 uv 바이너리를 멀티스테이지로 복사하도록 변경했습니다. pyproject.toml에 fuzz 선택적 의존성을 추가하고 관련 테스트 및 GitHub Actions 토큰 입력을 업데이트했습니다.

Changes

Cohort / File(s)	Summary
ClusterFuzzLite Docker & build script \.clusterfuzzlite/Dockerfile, \.clusterfuzzlite/build.sh	.clusterfuzzlite/Dockerfile에 UV_IMAGE ARG(sha256 고정) 및 uv-bin 스테이지를 추가하고 uv/uvx를 /usr/local/bin/으로 복사. build.sh는 pip3 install . pyinstaller atheris 대신 uv sync --frozen --extra fuzz를 사용하고 프로젝트 venv 경로를 PATH에 선행 추가.
Main Dockerfiles (CPU & NVIDIA) Dockerfile, Dockerfile.nvidia	PYTHON_BASE/NVIDIA_BASE 및 UV_IMAGE ARG로 베이스 이미지와 uv 이미지 다이제스트를 핀하고 uv-bin 멀티스테이지에서 바이너리 복사 방식으로 uv를 제공하도록 변경. 런타임/빌더 베이스 이미지를 ARG로 대체.
프로젝트 메타데이터 pyproject.toml	[project.optional-dependencies]에 fuzz extras 그룹을 추가 (atheris==3.0.0 ; platform_system == 'Linux' and python_version >= '3.11', pyinstaller==6.16.0).
테스트 업데이트 및 추가 tests/test_docker_delivery.py, tests/test_fuzzing_integration.py, tests/test_project_metadata.py	Dockerfile 베이스 이미지와 uv 참조의 sha256 고정 검증, build.sh 복사 및 uv sync --frozen --extra fuzz 사용 검증, GitHub Actions step에 github-token: ${{ github.token }} 검증 등 테스트 추가/수정.
GitHub Actions workflow .github/workflows/clusterfuzzlite.yml	google/clusterfuzzlite/actions/build_fuzzers@... 단계에 github-token: ${{ github.token }} 입력 추가.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• ci: add clusterfuzzlite smoke integration for dom normalization #28: 동일한 ClusterFuzzLite 아티팩트 (.clusterfuzzlite/Dockerfile, .clusterfuzzlite/build.sh)를 다루며 uv 설치/이미지 관련 변경 흐름과 직접 연관됩니다.
• ci: ship lean multi-arch images with optional NVIDIA publish #27: Dockerfile 및 NVIDIA 관련 Dockerflow 변경(uv 공급 방식 및 베이스 이미지 변경)과 중복 또는 연속되는 수정 지점을 공유합니다.

Poem

🐰 빌드의 숲에 다이제스트 달렸네,
작은 uv 바이너리들 줄지어 왔네.
venv로 길 닦고 sync로 춤추니,
테스트가 박수로 문을 열어주네.
당근 한 조각 축하로 남기겠네 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	제목은 Docker와 fuzz 의존성을 다이제스트로 고정하는 주요 변경사항을 명확하게 설명하고 있으며, 변경 세트와 완전히 관련이 있습니다.
Description check	✅ Passed	PR 설명은 변경사항의 요약, Git Flow 대상(develop), 검증 단계가 포함되어 있으며 템플릿의 필수 섹션을 충족합니다.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/pinned-deps-digests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[seonghobae]

@coderabbitai review

[seonghobae]

@coderabbitai resolve

[seonghobae]

@coderabbitai approve

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[seonghobae]

@coderabbitai resolve

[seonghobae]

@coderabbitai approve

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[seonghobae]

@coderabbitai approve

[seonghobae]

@coderabbitai resolve

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

🧹 Nitpick comments (1)

Dockerfile.nvidia (1)

4-6: uv-bin 스테이지도 플랫폼을 명시하는 편이 안전합니다.

builder 스테이지는 --platform=linux/amd64로 고정되어 있는데, uv-bin 스테이지는 플랫폼이 미지정되어 있습니다. UV_IMAGE가 멀티 아키텍처 이미지이므로, 호스트 아키텍처(예: arm64)에서 빌드할 때 uv-bin은 arm64로 빌드되지만 이 바이너리가 COPY --from=uv-bin으로 builder 스테이지에 복사될 때 아키텍처 불일치가 발생할 수 있습니다.

제안 diff

-FROM ${UV_IMAGE} AS uv-bin
+FROM --platform=linux/amd64 ${UV_IMAGE} AS uv-bin

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.nvidia` around lines 4 - 6, The uv-bin stage lacks an explicit
platform while builder is pinned to --platform=linux/amd64, which can cause
cross-arch mismatch when copying artifacts; update the uv-bin FROM to also use
--platform=linux/amd64 (i.e., change "FROM ${UV_IMAGE} AS uv-bin" to include
"--platform=linux/amd64") so the UV_IMAGE is pulled/built for the same
architecture as the builder stage and ensure any COPY --from=uv-bin operations
remain compatible.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@Dockerfile.nvidia`:
- Around line 4-6: The uv-bin stage lacks an explicit platform while builder is
pinned to --platform=linux/amd64, which can cause cross-arch mismatch when
copying artifacts; update the uv-bin FROM to also use --platform=linux/amd64
(i.e., change "FROM ${UV_IMAGE} AS uv-bin" to include "--platform=linux/amd64")
so the UV_IMAGE is pulled/built for the same architecture as the builder stage
and ensure any COPY --from=uv-bin operations remain compatible.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bc2256a8-6580-4a72-82d8-0db3c5bb995d

📥 Commits

Reviewing files that changed from the base of the PR and between d31a289 and 48d072a.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• .github/workflows/clusterfuzzlite.yml
• Dockerfile.nvidia
• pyproject.toml
• tests/test_docker_delivery.py
• tests/test_fuzzing_integration.py
• tests/test_project_metadata.py

✅ Files skipped from review due to trivial changes (1)

• pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (3)

• tests/test_project_metadata.py
• tests/test_docker_delivery.py
• tests/test_fuzzing_integration.py

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[seonghobae]

@coderabbitai resolve

[seonghobae]

@coderabbitai approve

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.