scorecard: pin dependencies as sugested by OpenSSF scorecard (#2761)

Signed-off-by: Sandor Szücs <[email protected]>
zalando · Dec 1, 2023 · 0cdb93a · 0cdb93a
1 parent 78aa08f
commit 0cdb93a
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -18,3 +18,7 @@ updates:
     directory: "/packaging"
     schedule:
       interval: "daily"
+  - package-ecosystem: "docker"
+    directory: "/fuzz"
+    schedule:
+      interval: "weekly"
diff --git a/fuzz/Dockerfile b/fuzz/Dockerfile
@@ -1,4 +1,4 @@
-FROM amazonlinux:2023
+FROM amazonlinux:2023@sha256:521e488723a1ae16055067e3b78954870cf1c08c9d45421b9f8ffad82b349e1c
 
 WORKDIR /workspace
 
@@ -8,7 +8,7 @@ COPY . .
 
 RUN dnf install -q -y make clang golang && \
     update-alternatives --install /usr/bin/cc cc /usr/bin/clang 20 && \
-    go install github.com/mdempsky/go114-fuzz-build@latest && \
+    go install github.com/mdempsky/go114-fuzz-build@v0.0.0-20200813011514-561a369ae6e1 && \
     go mod init fuzz && \
     go mod tidy && \
     make -s -j $(nproc) && \