CI/CD provider

ISSUE-103HighCI/CD Container Images

Container image is not pinned by digest

Q: Why is "Container image is not pinned by digest" a CI/CD security risk?

Even specific version tags (e.g., python:3.12.1) can be reassigned to a different image. Digest pinning is the only way to guarantee the exact image content used in your pipeline, providing the strongest supply chain security.

Control: Container images must be pinned by digest· Config key: containerImageMustNotUseForbiddenTags

📋 What is this?

When digest pinning is enabled in your configuration, every container image must be referenced by its SHA256 digest (image@sha256:...). This image is using a tag reference instead.

⚠️ Impact

Even specific version tags (e.g., python:3.12.1) can be reassigned to a different image. Digest pinning is the only way to guarantee the exact image content used in your pipeline, providing the strongest supply chain security.

🔧 How to fix

Replace the tag reference with a digest reference. You can find the digest using docker inspect or crane digest.

✗ BeforeEven specific version tags can be reassigned to a different image.

# .gitlab-ci.yml: ❌ Uses tag reference (not pinned by digest)
build:
  image: python:3.12.1
  script:
    - python setup.py build

✓ AfterSHA256 digest ensures the exact image content is always used.

# .gitlab-ci.yml: ✅ Pinned by SHA256 digest
build:
  image: python@sha256:1c5313e4a18...f4b8e
  script:
    - python setup.py build

# Find the digest with:
#   docker pull python:3.12.1
#   docker inspect --format='{{index .RepoDigests 0}}' python:3.12.1
# Or:
#   crane digest python:3.12.1

# .plumber.yaml
gitlab:
  controls:
    containerImageMustNotUseForbiddenTags:
      enabled: true
      containerImagesMustBePinnedByDigest: true

💡 Tips

Digest pinning is a sub-option of the containerImageMustNotUseForbiddenTags control, not a control of its own: containerImagesMustBePinnedByDigest defaults to true in the shipped config.
Use crane digest <image>:<tag> (from go-containerregistry) for a quick digest lookup.
Consider automating digest updates with tools like Renovate or Dependabot.

⚙️ Configuration

This control is configured in .plumber.yaml under the gitlab section:

gitlab:
  controls:
    containerImageMustNotUseForbiddenTags:
      enabled: true

See the CLI documentation for the full configuration reference.

ISSUE-103HighCI/CD Container Images

Container image is not pinned by digest

Control: Container images must be pinned by digest· Config key: containerImageMustNotUseForbiddenTags

📋 What is this?

When digest pinning is enabled in your configuration, every container image a workflow runs against (container: and services:) must be referenced by its SHA256 digest (image@sha256:...). This image is using a tag reference instead.

⚠️ Impact

Even specific version tags (e.g., node:20.18.1) can be reassigned to a different image. Digest pinning is the only way to guarantee the exact image content used in your workflow, providing the strongest supply chain security.

🔧 How to fix

Replace the tag reference with a digest reference. You can find the digest using docker inspect or crane digest.

✗ BeforeEven specific version tags can be reassigned to a different image.

# .github/workflows/build.yml: ❌ Uses tag reference (not pinned by digest)
jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: node:20.18.1
    steps:
      - run: npm ci && npm test

✓ AfterSHA256 digest ensures the exact image content is always used.

# .github/workflows/build.yml: ✅ Pinned by SHA256 digest
jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: node@sha256:bd3b3b7...9a1c4
    steps:
      - run: npm ci && npm test

# .plumber.yaml
github:
  controls:
    containerImageMustNotUseForbiddenTags:
      enabled: true
      containerImagesMustBePinnedByDigest: true

💡 Tips

Digest pinning is a sub-option of the containerImageMustNotUseForbiddenTags control, not a control of its own: containerImagesMustBePinnedByDigest defaults to true in the shipped config.
This control reads job container: and services: images. Pinning third-party actions by SHA is a separate check, ISSUE-701.
Use crane digest <image>:<tag> (from go-containerregistry) for a quick digest lookup.

⚙️ Configuration

This control is configured in .plumber.yaml under the github section:

github:
  controls:
    containerImageMustNotUseForbiddenTags:
      enabled: true

See the CLI documentation for the full configuration reference.

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configuration

🔗 Related issues

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configuration

🔗 Related issues