chore(deps): pin dependencies

.gitlab-ci.yml

@@ -38,7 +38,7 @@ run-pre-commit:
 
 check:
   stage: .pre
-  image: golang:1.23.2
+  image: golang:1.23.2@sha256:ad5c126b5cf501a8caef751a243bb717ec204ab1aa56dc41dc11be089fafcb4f
   script:
   - go install mvdan.cc/gofumpt@latest
   - go install golang.org/x/tools/cmd/goimports@latest
@@ -57,7 +57,7 @@ build:
 
 vulnerabilities:
   stage: build
-  image: golang:1.23.2
+  image: golang:1.23.2@sha256:ad5c126b5cf501a8caef751a243bb717ec204ab1aa56dc41dc11be089fafcb4f
   script:
   - go install golang.org/x/vuln/cmd/govulncheck@latest
   - govulncheck ./...
@@ -77,7 +77,7 @@ deploy-prod:
 check_release:
   stage: test
   image:
-    name: goreleaser/goreleaser:v2.4.1
+    name: goreleaser/goreleaser:v2.4.1@sha256:033324959cd5a16e458beec70af0ca038369a6d8064268159f1f140a6bdae1f6
     entrypoint: [ '' ]
   script: |
     goreleaser check
@@ -88,7 +88,7 @@ release:
   needs:
   - unbound_release_prepare_release
   image:
-    name: goreleaser/goreleaser:v2.4.1
+    name: goreleaser/goreleaser:v2.4.1@sha256:033324959cd5a16e458beec70af0ca038369a6d8064268159f1f140a6bdae1f6
     entrypoint: [ '' ]
   variables:
     # Disable shallow cloning so that goreleaser can diff between tags to

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23.2 as modules
+FROM golang:1.23.2@sha256:ad5c126b5cf501a8caef751a243bb717ec204ab1aa56dc41dc11be089fafcb4f as modules
 WORKDIR /build
 ADD go.* /build
 RUN go mod download