Container image is not pinned by digest

📋 What is this?

When digest pinning is enabled in your configuration, every container image must be referenced by its SHA256 digest (image@sha256:...). This image is using a tag reference instead.

⚠️ Impact

🔧 How to fix

Replace the tag reference with a digest reference. You can find the digest using docker inspect or crane digest.

# .gitlab-ci.yml — ❌ Uses tag reference (not pinned by digest)
build:
  image: python:3.12.1
  script:
    - python setup.py build

# .gitlab-ci.yml — ✅ Pinned by SHA256 digest
build:
  image: python@sha256:1c5313e4a18...f4b8e
  script:
    - python setup.py build

# Find the digest with:
#   docker pull python:3.12.1
#   docker inspect --format='{{index .RepoDigests 0}}' python:3.12.1
# Or:
#   crane digest python:3.12.1

# .plumber.yaml
controls:
  containerImagesMustBePinnedByDigest:
    enabled: true

💡 Tips

• Enable digest pinning in .plumber.yaml with containerImagesMustBePinnedByDigest: true.
• Use crane digest <image>:<tag> (from go-containerregistry) for a quick digest lookup.
• Consider automating digest updates with tools like Renovate or Dependabot.

⚙️ Configuration

This control is configured in .plumber.yaml under the key:

controls:
  containerImagesMustBePinnedByDigest:
    enabled: true

See the CLI documentation for the full configuration reference.

🔗 Related issues