Pinning images in GitLab CI
Why it matters
An image: without a tag or digest pulls whatever is current, so the pipeline you reviewed is not the pipeline that runs.
How to fix it
Name an exact version, or better a digest:
image: python:3.12.7-slim
image: python@sha256:<digest> # cannot be repointed
Renovate can keep either up to date.
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.
Related checks
- How to find and remove secrets committed to a Git repository
- Why .env must be in .gitignore (and how to check it is not already committed)
- A .env file is committed to the repository: what to do
- Automated dependency updates with Dependabot or Renovate
- How to pin GitHub Actions to a commit SHA
- Least-privilege GITHUB_TOKEN permissions in workflows