pin docker image to hash

Author: vszakats

_bumper.sh

@@ -44,7 +44,17 @@ Authorization: Bearer ${token}
 EOF
 )"
 
-echo; echo "export DOCKER_IMAGE='${name}:${tag}'"
+cpu='amd64'
+digest="$(curl --disable --user-agent '' --silent --fail --show-error \
+    --header 'Accept: application/json' \
+    --header @/dev/stdin \
+    "https://registry-1.docker.io/v2/library/${name}/manifests/${tag}" <<EOF \
+  | jq --raw-output --arg cpu "${cpu}" '.manifests[] | select(.platform.architecture == $cpu and .platform.os == "linux") | .digest'
+Authorization: Bearer ${token}
+EOF
+)"
+
+echo; echo "export DOCKER_IMAGE='${name}@${digest}'  # ${tag} ${cpu}"
 
 # Find out the latest AppVeyor CI Ubuntu worker image
 

_versions.sh

@@ -3,7 +3,7 @@
 # Copyright (C) Viktor Szakats. See LICENSE.md
 # SPDX-License-Identifier: MIT
 
-export DOCKER_IMAGE='debian:testing-20250908-slim'
+export DOCKER_IMAGE='debian@sha256:f698e6243e87c0d6b727daae959c3f15a64a3a39cc280a2dd1305d007b3d5f27'  # testing-20250908-slim amd64
 
 export CURL_VER_='8.16.0'
 export CURL_HASH=40c8cddbcb6cc6251c03dea423a472a6cea4037be654ba5cf5dec6eb2d22ff1d