How to avoid outdated images with unpinned-images

[SMillerDev]

I have some images that use a release branch, but they are flagged by the unpinned-images check. Fair enough, but if I pin them they will quickly become outdated. Can Dependabot be configured to update these references in GitHub actions somehow, or is this just something you'll need to manually fix?

Ref: https://docs.zizmor.sh/audits/#unpinned-images

[woodruffw]

Ah yeah, I think Dependabot unfortunately can't do that. I believe Renovate can, but I'm less familiar with it.

I believe @tnytown was looking a bit into a "stale OCI images" audit, but it's nontrivial (since we'd need to contact arbitrary OCI registries + deal with their auth). But long term that's something I'm interested in zizmor being able to flag as well 🙂

[TrueNix]

Expanding on @woodruffw's answer — here are the concrete options for keeping pinned images up to date without manual work:

Option 1: Renovate (recommended)

Renovate supports updating container image references in GitHub Actions workflow files. It can bump uses: docker://image:tag and uses: ./.github/actions/foo (if the action uses a container) to newer digests or tags.

Configure renovate.json:

{
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchManagers": ["github-actions"],
      "matchDatasources": ["docker"],
      "pinDigests": true
    }
  ]
}

This pins to @sha256:... and then keeps the digest updated as new images are published. Renovate opens PRs automatically when a new digest is available.

Option 2: Pin to a floating tag with digest fallback

If you need to track a rolling tag (e.g., myimage:latest) for operational reasons, you can pin the digest at build time using a reusable workflow that resolves the current digest:

- name: Resolve image digest
  id: digest
  run: |
    digest=$(docker buildx imagetools inspect myimage:latest --format '{{json .Manifest.Digest}}' | tr -d '"')
    echo "digest=$digest" >> "$GITHUB_OUTPUT"

Then use the resolved digest in subsequent steps. This is more of a CI pattern than a zizmor workaround, but it satisfies the audit while keeping the image current.

Option 3: Accept the risk and suppress

If you intentionally want a floating tag (e.g., for a dev workflow), suppress the finding with a # zizmor: ignore comment or via the --ignore flag for that specific audit:

zizmor --ignore unpinned-images .

Or in the audit config:

unpinned-images:
  ignore:
    - .github/workflows/dev.yml

Why Dependabot can't do this

Dependabot's GitHub Actions manager handles uses: references for action repos (e.g., actions/checkout@v4), but it doesn't resolve container image digests from OCI registries. That's a different ecosystem (Docker Hub, ghcr.io, ECR) with its own API, auth, and rate-limiting concerns. Renovate has a dedicated docker datasource manager that handles this natively.

Summary

Approach	Auto-updates?	Pins to digest?	Effort
Renovate	Yes (opens PRs)	Yes	Low — config file
Digest resolution in CI	Yes (at build time)	Yes	Medium — workflow changes
Suppress the audit	N/A	No	Trivial

For production workflows, Renovate is the cleanest answer. For dev/throwaway workflows, suppressing is fine.