ossf: pin docker versions (#1056)

Signed-off-by: Matthieu MOREL <[email protected]>

.github/dependabot.yml

@@ -1,5 +1,13 @@
 version: 2
 updates:
+- package-ecosystem: docker
+  directory: /ci/docker
+  schedule:
+    interval: daily
+- package-ecosystem: docker
+  directory: /benchmarks/docker
+  schedule:
+    interval: daily
 - package-ecosystem: github-actions
   directory: /
   schedule:

README.md

@@ -2,6 +2,8 @@
 
 *A L7 (HTTP/HTTPS/HTTP2) performance characterization tool*
 
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/envoyproxy/nighthawk/badge)](https://api.securityscorecards.dev/projects/github.com/envoyproxy/nighthawk)
+
 ## Current state
 
 Nighthawk currently offers:

benchmarks/docker/Dockerfile-benchmark

@@ -1,4 +1,4 @@
-FROM frolvlad/alpine-python3
+FROM frolvlad/alpine-python3@sha256:cc524b08e68d0545c0d89bb426aeb71359d6146eca941480efa778fd64dd4714
 
 RUN apk add docker openrc
 RUN rc-update add docker boot
@@ -11,4 +11,4 @@ ENV ENVOY_PATH="envoy" \
     RUNFILES_DIR="/usr/local/bin/benchmarks/benchmarks.runfiles/" \
     ENVOY_IP_TEST_VERSIONS="v4only"
 
-CMD ["./benchmarks", "--help"]
+CMD ["./benchmarks", "--help"]

ci/docker/Dockerfile-nighthawk

@@ -1,4 +1,4 @@
-FROM frolvlad/alpine-glibc:alpine-3.13_glibc-2.32
+FROM frolvlad/alpine-glibc:alpine-3.13_glibc-2.32@sha256:cc9a97ed4e27fe0129056fa422d1c54f5a2f7ebe9a2856d7d5a15f17a17614fc
 
 ADD nighthawk_client /usr/local/bin/nighthawk_client
 ADD nighthawk_test_server /usr/local/bin/nighthawk_test_server

ci/docker/Dockerfile-nighthawk-benchmark

@@ -1,4 +1,4 @@
-FROM frolvlad/alpine-glibc:alpine-3.13_glibc-2.32
+FROM frolvlad/alpine-glibc:alpine-3.13_glibc-2.32@sha256:cc9a97ed4e27fe0129056fa422d1c54f5a2f7ebe9a2856d7d5a15f17a17614fc
 
 CMD ["./benchmarks" "--help"]
 ENV RUNFILES_DIR=/usr/local/bin/benchmarks/benchmarks.runfiles