Pin Dockerfile base image?

[shaanmajid]

zizmor's Dockerfile currently uses the mutable cgr.dev/chainguard/wolfi-base:latest tag. Would the project be open to pinning both this image reference to a digest (i.e., latest@sha256...) in the interest of reproducible builds? The existing Docker Dependabot configuration should appropriately update the digest as needed.

Happy to open a PR for this; just wanted to make sure this wasn't deliberately omitted for any reason.

[woodruffw]

It was half-intentional: my understanding is that wolfi-base is a rolling image, i.e. it's getting updated multiple times a day. But I'm okay with pinning ti and then ensuring that Docker updates it every week, like the other updates.