Pin container images and hash-verify artifact downloads (OpenSSF Scorecard gaps)

[WilliamBerryiii]

Summary

OpenSSF Scorecard Pinned-Dependencies check identified several unpinned container images and unverified artifact downloads. GitHub Actions (119/119) and npm commands (5/5) are fully pinned, but container images (1/4), pip commands (0/2), and download-then-run scripts (0/2) have gaps.

Container Images Needing @sha256: Digests

File	Line	Current	Gap
data-management/viewer/backend/Dockerfile	3	python:3.11-slim	No digest
data-management/viewer/frontend/Dockerfile	4	node:24.14.1-slim	No digest
data-management/viewer/frontend/Dockerfile	30	nginx:1.27-alpine	No digest

Pip/uv Bootstrap Pinning

File	Line	Current	Gap
data-management/viewer/backend/Dockerfile	12	pip install --no-cache-dir uv	No version at all
evaluation/sil/docker/Dockerfile.lerobot-eval	8	uv>=0.6.0,<1.0.0	Range, not exact pin

Download-then-Run Scripts (No Hash Verification)

File	Line	Tool	Severity
setup-dev.sh	49	uv 0.10.9 installer	High
training/rl/scripts/train.sh	57	uv 0.10.9 installer	High
infrastructure/setup/optional/isaac-sim-vm/scripts/install-dev-deps.sh	151	uv installer (no version, runs as root)	Critical
setup-dev.sh	62-79	terraform-docs v0.21.0	Medium

Devcontainer onCreateCommand Gaps

Entry	Current	Gap
tflint	curl | bash with TFLINT_VERSION=v0.61.0	No hash verification

Note

osmo-cli (tracks main branch) and ngc-cli (versionless download URL) are harder to pin and may be addressed separately in a follow-up issue.

Approach

Follow the existing hash-verify pattern in devcontainer.json (actionlint/golangci-lint): download to temp file, verify SHA256 with sha256sum -c, then install. Pin container images with @sha256: digests. Pin uv to exact versions in Dockerfiles.

Acceptance Criteria

• All three Dockerfile base images include @sha256: digests
• uv is pinned to an exact version in both Dockerfiles
• setup-dev.sh uv and terraform-docs downloads are hash-verified
• train.sh uv download is hash-verified
• install-dev-deps.sh uv download is version-pinned and hash-verified
• devcontainer.json tflint uses the same hash-verify pattern as actionlint/golangci-lint