fix(ci): bump python:3.11-slim base image digest (2026-08-13)

The pinned python:3.11-slim digest from 2026-08-09 accumulated high-severity
CVEs in Debian bookworm packages, causing the anchore/scan-action grype scan
to fail at severity-cutoff: high. Updated to the current 2026-08-13 digest
(a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1) across
all 6 references: Dockerfile, release.yml (container + evidence string),
scripts/release_evidence.py, and both test files.

Verified: test_release_evidence.py and test_release_infrastructure.py pass.

Author: Coding-Dev-Tools

.github/workflows/release.yml

@@ -153,7 +153,7 @@ jobs:
     name: Independent distribution builder ${{ matrix.builder }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    container: python:3.11-slim@sha256:90744cff8f32887f075c47d747a173ff333e9e98801667af93c357fa9f5e28ff
+    container: python:3.11-slim@sha256:a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1
     if: >-
       github.event_name == 'push' ||
       inputs.release_tag == ''
@@ -223,7 +223,7 @@ jobs:
 
           image = (
               "python:3.11-slim@sha256:"
-              "90744cff8f32887f075c47d747a173ff333e9e98801667af93c357fa9f5e28ff"
+              "a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1"
           )
 
           def digest(path):

Dockerfile

@@ -1,5 +1,5 @@
 # Engraphis — self-hosted AI memory engine. Local-first; you bring the LLM.
-FROM python:3.11-slim@sha256:90744cff8f32887f075c47d747a173ff333e9e98801667af93c357fa9f5e28ff AS base
+FROM python:3.11-slim@sha256:a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1 AS base
 
 # ENGRAPHIS_HOST is deliberately NOT set here: docker-entrypoint.sh chooses IPv6 for a
 # Railway deployment (which injects RAILWAY_SERVICE_NAME) and 0.0.0.0 for ordinary Docker.

scripts/release_evidence.py

@@ -31,7 +31,7 @@
 _IMAGE_DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
 _BUILDER_IMAGE = (
     "python:3.11-slim@sha256:"
-    "90744cff8f32887f075c47d747a173ff333e9e98801667af93c357fa9f5e28ff"
+    "a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1"
 )
 _BUILDER_TOOLCHAIN = {
     "build": "1.5.0",

tests/test_release_evidence.py

@@ -137,7 +137,7 @@ def _release_inputs(root, dist):
             "name": name,
             "image": (
                 "python:3.11-slim@sha256:"
-                "90744cff8f32887f075c47d747a173ff333e9e98801667af93c357fa9f5e28ff"
+                "a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1"
             ),
             "python": "3.11",
             "environment_lock_sha256": "e" * 64,
@@ -515,7 +515,7 @@ def test_release_workflow_publishes_complete_captured_evidence():
     assert "name: build-environment-evidence" in build
     assert "dist-repeat" not in build
     assert "Independent distribution builder ${{ matrix.builder }}" in reproducibility
-    assert "python:3.11-slim@sha256:90744cff" in reproducibility
+    assert "python:3.11-slim@sha256:a630a63c" in reproducibility
     assert 'builder: ["a", "b"]' in reproducibility
     assert "Compare independent distribution builders" in reproducibility
     assert "name: independent-reproducibility" in reproducibility

tests/test_release_infrastructure.py

@@ -199,7 +199,7 @@ def test_ci_and_release_audit_production_image_dependencies():
     assert (
         _text("Dockerfile").splitlines()[1]
         == "FROM python:3.11-slim@sha256:"
-        "90744cff8f32887f075c47d747a173ff333e9e98801667af93c357fa9f5e28ff AS base"
+        "a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1 AS base"
     )
     assert "Verify production image OCR runtime" in ci
     assert "Verify production image OCR runtime" in release
@@ -300,7 +300,7 @@ def test_release_builds_one_portable_open_core_wheel():
     assert release.count("python -m build") == 2
     assert "python -m build --outdir dist-repeat" not in release
     assert 'builder: ["a", "b"]' in release
-    assert "python:3.11-slim@sha256:90744cff" in release
+    assert "python:3.11-slim@sha256:a630a63c" in release
     assert "Compare independent distribution builders" in release
     assert "python scripts/verify_distribution_contents.py dist/*" in release
     assert "Build compiled wheels" not in release