Pin dependencies

.github/workflows/docker_publish.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
       # Checkout the repository
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Generate XNAT container service labels
         id: xnat-command-label
@@ -50,7 +50,7 @@ jobs:
 
       # Log into the container registry
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -62,7 +62,7 @@ jobs:
       # custom nrg label in the build-push-action below
       - name: Extract metadata for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           # labels: 'org.nrg.commands=${{ steps.xnat-command-label.outputs.nrglabel }}'
@@ -78,7 +78,7 @@ jobs:
       # Tag and label the image using the output from the metadata step above
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6
         with:
           context: .
           push: true

Dockerfile

@@ -1,6 +1,6 @@
 # Python image to use in both stages
 ARG PYTHON_IMAGE=python
-ARG PYTHON_VERSION=3.10-alpine3.20
+ARG PYTHON_VERSION=3.10-alpine3.20@sha256:df055162b4fafcf1db0c86eaf24df3e1551ce4743cbda55d5f8d529cc6e0d94d
 
 # Build stage
 FROM ${PYTHON_IMAGE}:${PYTHON_VERSION} AS builder