Security fix: Dockerfile not known

What it means

Returned by POST /orgs/{org}/code-security/images/findings/{id}/autofix (Security fixes). No pull request was requested.

Since 2026-10-14 the same refusal is answered with the type security-fix-image-source-unknown from POST /orgs/{org}/dependency-updates/security-fixes/requests. The paths above are deprecated and keep answering autofix-image-source-unknown until 2027-10-15. Branch on either type.

Example detail message returned with this error:

• fremforge cannot tell which repository and commit built this image. Build and push it from an Actions run of a repository in this organisation, or add the OCI labels org.opencontainers.image.source and org.opencontainers.image.revision (docker/metadata-action sets both). The next image scan then finds its Dockerfile.

The response also carries "reason": "image_source_unknown".

What to do

fremforge could not tell which Dockerfile built the image: the image carries no org.opencontainers.image.source and org.opencontainers.image.revision labels and was not pushed by an Actions run of a repository in your organisation, no Dockerfile in that commit has a base the image starts with, two do, or the base’s registry could not be read. The detail says which. Build and push the image from Actions, or add the labels when you build it (docker/metadata-action sets both).

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-image-source-unknown",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "...",
  "reason": "image_source_unknown"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.