Security fix: image not analysed yet

What it means

Returned by POST /orgs/{org}/code-security/images/findings/{id}/autofix (Security fixes). No pull request was requested.

Since 2026-10-14 the same refusal is answered with the type security-fix-image-not-attributed from POST /orgs/{org}/dependency-updates/security-fixes/requests. The paths above are deprecated and keep answering autofix-image-not-attributed until 2027-10-15. Branch on either type.

Example detail message returned with this error:

• This image has no base-image analysis yet. fremforge works out which Dockerfile built a pushed image and which findings its base brought at the daily image scan; ask again after it.

The response also carries "reason": "image_not_attributed".

What to do

The base-image analysis runs with the daily image scan, for images pushed to your organisation’s registry. Ask again after the next scan. Images pulled through the dependency proxy and repository scans are never analysed: no Dockerfile of yours built them.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-image-not-attributed",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "...",
  "reason": "image_not_attributed"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.