Hash Pin docker images

[joycebrum]

Also related to #62471, would you consider hash pin the docker images?

The security benefit of doing so is that it mitigates the risk of typosquatting attacks since the images are public. If there is a need for them to be updated regularly, I can also submit a .github/dependabot file to update the docker images regularly (weekly or monthly for example).

Besides, AFAIUC, the dockerfiles are used for build and tests, which lead to another benefit of hash pinning: reliability and stability.

Let me know your thoughts about i.

Thanks!

[angerson]

Pinning is a pain when working on these containers. I'm fine with the change as long as you update this PR to alleviate the trouble for developers:

• Add a dependabot job to keep the shas updated, and add a sha if there is not one
• Add a comment on each affected FROM line that links to the job definition and explains that a sha will be added automatically post-submission

[joycebrum]

Hi, I can add the dependabot config file to automatically update the digests on the dockerfiles (which is in fact a security practice too), although dependabot has no feature yet to automatically add hash when there is not one.

The renovatebot, although being a third party tool (not GitHub owned), it has an option to pin digests automatically to the given ecosystem (docker images). It would need to be installed on the repo, but only with read permissions, because we can use the forking renovate.

Would you be interested on the renovatebot instead (I can submit a config file for it) or the dependabot only updating the hashes and versions periodically would be enough to alleviate the trouble for developers?

[joycebrum]

An additional feature of renovatebot would be the manual update -- when you select a image and ask for an update without having to wait for the next run of renovatebot job

[gbaned]

Hi @angerson Any update on this PR? Please. Thank you!

[gbaned]

Hi @angerson Any update on this PR? Please. Thank you!

[joycebrum]

I've suggested the configuration file for dependabot to show how it would like to update both the actions and the dockerfiles. Dependabot will automatically update the hashes and comments, but it is not able to automatically add a sha when there is none.

[mihaimaruseac]

This LGTM to me, but leave approval to Austin.

[gbaned]

Hi @angerson Can you please review this PR ? Thank you!

[gbaned]

Hi @joycebrum Can you please resolve conflicts? Thank you!

[joycebrum]

Done!

[gbaned]

Hi @MichaelHudgins Can you please review this PR ? Thank you!