Merge pull request #565 from apigee/issue564

chore: adds pinned dependencies #564

.devcontainer/Dockerfile

@@ -12,9 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM gcr.io/projectsigstore/cosign:latest as cosign
+FROM gcr.io/projectsigstore/cosign:latest@sha256:b03690aa52bfe94054187142fba24dc54137650682810633901767d8a3e15b31 as cosign
 
-FROM mcr.microsoft.com/devcontainers/go:1-1.22-bookworm
+FROM mcr.microsoft.com/devcontainers/go:1.23-bookworm@@sha256:2e00578e7c526e76ebd51597260928d8542d27c17ffe6390d79200638c51a3e6
 
 COPY --from=cosign /ko-app/cosign /usr/bin
 

Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.23 AS builder
+FROM golang:1.23.2@sha256:a7f2fc9834049c1f5df787690026a53738e55fc097cd8a4a93faa3e06c67ee32 AS builder
 
 ARG TAG
 ARG COMMIT
@@ -33,7 +33,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -buildvcs=true -a -
 FROM ghcr.io/jqlang/jq:latest AS jq
 
 # use debug because it includes busybox
-FROM gcr.io/distroless/static-debian11:debug-nonroot
+FROM gcr.io/distroless/static-debian11:debug-nonroot@sha256:55716e80a7d4320ce9bc2dc8636fc193b418638041b817cf3306696bd0f975d1
 LABEL org.opencontainers.image.url='https://github.com/apigee/apigeecli' \
       org.opencontainers.image.documentation='https://github.com/apigee/apigeecli' \
       org.opencontainers.image.source='https://github.com/apigee/apigeecli' \