Harden CI image refs for supply chain

Author: eapache-opslevel

.github/workflows/release.yaml

@@ -15,7 +15,7 @@ jobs:
     steps:
       - 
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
           submodules: 'true'
@@ -34,11 +34,11 @@ jobs:
           rm -rf ./charts/opslevel
       - 
         name: Install Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           version: v3.4.0
       - 
         name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.7.0
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

scripts/elasticsearch.sh

@@ -3,7 +3,7 @@
 # Set your private registry
 PRIVATE_REGISTRY="746108190720.dkr.ecr.us-east-1.amazonaws.com"
 IMAGE_NAME="elasticsearch"
-VERSION="8.17.3"
+VERSION="8.17.3@sha256:224c75e346bd745ce908f06a1cbad7bf10988961dcdcdfccb22556b3f856b3f0"
 SOURCE_IMAGE="docker.elastic.co/elasticsearch/elasticsearch:$VERSION"
 
 # Ensure Docker CLI experimental features are enabled
@@ -43,4 +43,4 @@ docker manifest annotate $MANIFEST_TAG $PRIVATE_REGISTRY/$IMAGE_NAME:$VERSION-ar
 echo "Pushing multi-arch manifest to $PRIVATE_REGISTRY..."
 docker manifest push $MANIFEST_TAG
 
-echo "Multi-arch image pushed successfully: $MANIFEST_TAG"
+echo "Multi-arch image pushed successfully: $MANIFEST_TAG"