Pin dependencies

Dockerfile

@@ -1,7 +1,7 @@
-# syntax=docker/dockerfile:1
+# syntax=docker/dockerfile:1@sha256:fe40cf4e92cd0c467be2cfc30657a680ae2398318afd50b0c80585784c604f28
 ARG PYVER=3.11.9
 ARG ALPTAG=3.20@sha256:0a4eaa0eecf5f8c050e5bba433f58c052be7587ee8af3e8b3910ef9ab5fbe9f5
-FROM python:${PYVER}-alpine${ALPTAG} as builder
+FROM python:latest@sha256:11aa4b620c15f855f66f02a7f3c1cd9cf843cc10f3edbcf158e5ebcd98d1f549:${PYVER}-alpine${ALPTAG} as builder
 
 # Add the community repo for access to patchelf binary package
 ARG ALPTAG
@@ -32,7 +32,7 @@ RUN python3 post4docker.py
 
 ### Copy frozen binary to the container that will actually be published
 ARG ALPTAG
-FROM alpine:${ALPTAG}
+FROM alpine:latest@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d:${ALPTAG}
 RUN apk --no-cache upgrade && apk --no-cache add openssl-dev expat
 # The path `curator_build` is from `builder` and `post4docker.py`
 COPY --from=builder curator_build /curator/

docker_test/scripts/Dockerfile.tmpl

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:experimental
+# syntax=docker/dockerfile:experimental@sha256:600e5c62eedff338b3f7a0850beb7c05866e0ef27b2d2e8c02aa468e78496ff5
 ARG VERSION=ES_VERSION
 FROM elasticsearch:${VERSION}