CICD-SEC-3 — Unpinned container image

Container images pinned by a mutable tag can be repointed by the registry. Pin by digest.

Field	Value
Category	CICD-SEC-3
Severity	MEDIUM
OWASP	CICD-SEC-3: Dependency Chain Abuse
Auto-fix	✗ (digest resolution requires a registry round-trip; pin manually)

What the check does

Flags container images referenced by a mutable tag instead of an immutable @sha256: digest, across the three places a workflow pulls an image:

• a job-level container: (scalar image:tag or a mapping with image:)
• a services.<name>.image
• a step uses: docker://image:tag

Images whose value is a pure expression (${{ ... }}) are skipped — the reference isn’t knowable statically.

Why it matters

A tag such as :latest or :18 is a moving pointer. The registry (or an attacker who compromises it, or the publishing account) can repoint that tag to a different image between runs. Your workflow then pulls and executes code you never reviewed — often with repository secrets and a writable token in scope. This is the container-image analog of CICD-SEC-3 unpinned actions.

Pinning by digest makes the reference content-addressed: the bytes can’t change without the digest changing.

Vulnerable example

jobs:
  build:
    runs-on: ubuntu-latest
    container: node:18                 # ← mutable tag
    services:
      db:
        image: postgres:16            # ← mutable tag
    steps:
      - uses: docker://alpine:3.18    # ← mutable tag

Safe alternative

jobs:
  build:
    runs-on: ubuntu-latest
    container: node@sha256:a1b2c3...  # digest, optionally with a tag comment
    services:
      db:
        image: postgres@sha256:d4e5f6...
    steps:
      - uses: docker://alpine@sha256:7890ab...

Resolve a tag to its digest with docker buildx imagetools inspect <image>:<tag> (or crane digest), and keep the digest current with Dependabot or Renovate, both of which update digest-pinned images.