decolint on GitHub

pin-feature-exact-version

disallow a Feature reference that does not pin a full “major.minor.patch” version

Category
reproducibility
Applies to
devcontainer, feature
Platforms
all

Why

A Feature is published under its full version and under the “major” and “major.minor” tags, and the publisher moves those shorter tags with every release. So :1 installs whatever 1.x is current at build time: the Feature can change what it installs, add options, or change their defaults, and the container changes with it. Only the full version names one published Feature for good.

A reference pinned by digest is accepted as it already names exact content.

Bad

{
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
  "features": {
    "ghcr.io/devcontainers/features/go:1": {}
  }
}

Good

{
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
  "features": {
    "ghcr.io/devcontainers/features/go:1.3.2": {}
  }
}

A Feature’s own dependsOn entries are checked the same way.

References