fix: pin all external refs to cryptographic identity (closes #118 )

- Dockerfile: Pin golang and alpine base images to sha256 digests - Dockerfile: Pin golangci-lint to v2.10.1 and goimports to v0.42.0 - CI workflows already pinned to commit SHAs (no changes needed)
2026-02-20 10:45:02 -08:00
1 changed files with 2 additions and 2 deletions
--- a/4
+++ b/4
@ -4,8 +4,8 @@ FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4
 RUN apk add --no-cache git make gcc musl-dev
 # Install golangci-lint v2
-RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee # v2.10.1
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10.1
-RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0 # v0.42.0
+RUN go install golang.org/x/tools/cmd/goimports@v0.42.0
 WORKDIR /src
 COPY go.mod go.sum ./