# Ideas & backlog

A living list of potential improvements for opencode-devbox that are **not yet
scheduled**. This is intentionally lightweight — a place to park ideas so they
aren't lost between sessions. When an item ships, describe it in
[`CHANGELOG.md`](CHANGELOG.md) and remove it from here.

Rough effort tags: 🟢 small · 🟡 medium · 🔴 large. Status: `idea` (unvetted) ·
`planned` (agreed, not started).

---

## Supply-chain hardening

- 🟡 `planned` — **Pin CI actions to commit SHAs.** The workflows use floating
  major tags (`actions/checkout@v4`, `docker/build-push-action@v7`,
  `docker/setup-buildx-action@v4`, `docker/login-action@v3`,
  `docker/setup-qemu-action@v3`). This is inconsistent with the project's own
  philosophy of SHA-pinning *content* refs to defeat floating refs. Pin each
  action to a SHA with a trailing `# vX.Y.Z` comment. Pairs naturally with the
  renovate item below to keep the pins fresh.

- 🟡 `planned` — **Vulnerability scanning in CI.** No CVE scan runs on the
  published images today. Add a `trivy image` (or grype) job to
  `docker-publish-split.yml` after `smoke`. Start non-blocking (report only),
  then tighten to fail on `HIGH`/`CRITICAL` with an available fix.

- 🟢🟡 `planned` — **Standardize build provenance → buildx SBOM + attestations.**
  The image already carries hand-rolled provenance (OCI labels +
  `build-manifest`). `docker/build-push-action` can emit a standard SBOM and
  SLSA provenance attestation nearly for free (`provenance: mode=max`,
  `sbom: true`). Makes provenance machine-consumable and pairs well with the
  trivy item (scan the SBOM).

## Dockerfile hardening

- 🟡 `idea` — **Address hadolint DL4006 properly.** Currently ignored in
  `.hadolint.yaml`. The clean fix is `SHELL ["/bin/bash", "-o", "pipefail",
  "-c"]` so piped `RUN`s fail on the first non-zero stage. This changes the
  default `RUN` shell from `sh` to `bash` for all subsequent layers, so it is
  base-affecting and needs a careful pass over existing `RUN`s before removing
  the ignore.

## Developer experience

- 🟢 `idea` — **`Makefile`/`justfile` for local iteration.** Reproducing a CI
  build locally means hand-assembling many `--build-arg`s. Thin targets
  (`make build-base`, `make build-variant`, `make smoke`, `make lint`) would
  make local testing painless and document the canonical invocations.

- 🟡 `idea` — **Dependency-update automation (renovate).** With CI actions
  SHA-pinned (above), a `renovate.json` keeps those pins — plus the pinned tool
  versions (`ACTIONLINT_VERSION`, `HADOLINT_VERSION`, gosu, etc.) — current via
  automated PRs. Requires a renovate runner against the Gitea instance.

## Housekeeping

- 🟢 `idea` — **Registry retention for `base-<hash>` tags.** The base-hash
  caching scheme accumulates `base-<hash>` tags over time. Confirm whether the
  registry prunes old ones, and add a retention/cleanup step if not.