From 168077b7d6a0dca7b0836ab56bfeda7f17bee204 Mon Sep 17 00:00:00 2001
From: Mustapha-Yinka Yusuf <mustaphayusuf2216@gmail.com>
Date: Thu, 20 Aug 2026 19:21:36 +0100
Subject: [PATCH 1/3] Add CI workflow to verify Docker build (#178)

---
 .github/workflows/docker-build.yaml | 39 +++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/docker-build.yaml

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
new file mode 100644
index 00000000..74eac55e
--- /dev/null
+++ b/.github/workflows/docker-build.yaml
@@ -0,0 +1,39 @@
+name: Docker Build
+
+on:
+  push:
+    branches:
+      - master
+      - main
+      - copybara_push
+    paths:
+      - 'Dockerfile'
+      - '.github/workflows/docker-build.yaml'
+  pull_request:
+    branches:
+      - master
+      - main
+      - copybara_push
+    paths:
+      - 'Dockerfile'
+      - '.github/workflows/docker-build.yaml'
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build Docker image
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        push: false
+        tags: sbsim:ci-build
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
\ No newline at end of file

From 1844e9ea7a28d07bd0de495f9b3cbc695fcda33a Mon Sep 17 00:00:00 2001
From: Mustapha-Yinka Yusuf <mustaphayusuf2216@gmail.com>
Date: Thu, 20 Aug 2026 19:44:49 +0100
Subject: [PATCH 2/3] Pin actions to commit SHAs and scope permissions per
 zizmor findings

---
 .github/workflows/docker-build.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index 74eac55e..c0efe86b 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -18,19 +18,22 @@ on:
       - 'Dockerfile'
       - '.github/workflows/docker-build.yaml'
 
+permissions:
+  contents: read
+
 jobs:
   docker-build:
     runs-on: ubuntu-latest
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.2.2
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
     - name: Build Docker image
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
       with:
         context: .
         push: false

From 950ad4a2c7887a08d76a85f1d1f2b1b82bba649b Mon Sep 17 00:00:00 2001
From: Mustapha-Yinka Yusuf <mustaphayusuf2216@gmail.com>
Date: Thu, 20 Aug 2026 19:47:50 +0100
Subject: [PATCH 3/3] Fix mismatched checkout action SHA pin

---
 .github/workflows/docker-build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index c0efe86b..ffb9b87a 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1