release/ci: Fix code scanning pin alerts (envoyproxy#36219)

Signed-off-by: Ryan Northey <ryan@synca.io>
phlax · Sep 20, 2024 · bb2dfc9 · bb2dfc9
1 parent d6120f3
commit bb2dfc9
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/ci/Dockerfile-envoy b/ci/Dockerfile-envoy
@@ -1,5 +1,6 @@
 ARG BUILD_OS=ubuntu
-ARG BUILD_TAG=22.04@sha256:adbb90115a21969d2fe6fa7f9af4253e16d45f8d4c1e930182610c4731962658
+ARG BUILD_TAG=22.04
+ARG BUILD_SHA=adbb90115a21969d2fe6fa7f9af4253e16d45f8d4c1e930182610c4731962658
 ARG ENVOY_VRP_BASE_IMAGE=envoy-base
 
 
@@ -13,7 +14,7 @@ ADD "${TARGETPLATFORM}/release.tar.zst" /usr/local/bin/
 
 
 # STAGE: envoy-base
-FROM ${BUILD_OS}:${BUILD_TAG} AS envoy-base
+FROM ${BUILD_OS}:${BUILD_TAG}@sha256:${BUILD_SHA} AS envoy-base
 ENV DEBIAN_FRONTEND=noninteractive
 EXPOSE 10000
 CMD ["envoy", "-c", "/etc/envoy/envoy.yaml"]