007.md

deny_job_container_latest_image

Job's container image tag should not be latest.

Examples

❌

jobs:
  container-test-job:
    runs-on: ubuntu-latest
    container:
      image: node:latest # latest tags should not be used

⭕

jobs:
  container-test-job:
    runs-on: ubuntu-latest
    container:
      image: node:10 # Ideally, hash is best

Why?

Image tags should be pinned with tag or hash.