fluid-cloudnative · yangyuliufeng · Jun 19, 2025 · Jun 19, 2025 · Jun 19, 2025
diff --git a/.github/workflows/kind-e2e.yml b/.github/workflows/kind-e2e.yml
@@ -40,7 +40,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4.3.0
+        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
 
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -73,7 +73,7 @@ jobs:
 
       - name: Dump environment
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: gha-e2e-logs-${{ github.job }}-${{ matrix.kubernetes-version }}
           path: "src/github.com/fluid-cloudnative/fluid/e2e-tmp/testcase-*.tgz"

diff --git a/.github/workflows/project-check.yml b/.github/workflows/project-check.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dominikh/staticcheck-action@v1
+      - uses: dominikh/staticcheck-action@fe1dd0c3658873b46f8c9bb3291096a617310ca6 # v1
 
   lint:
     runs-on: ubuntu-latest
@@ -29,7 +29,7 @@ jobs:
         working-directory: ${{ env.GOPATH }}/src/github.com/fluid-cloudnative/fluid
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -84,7 +84,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
       with:
         go-version: ${{ env.GO_VERSION }}
 

diff --git a/addons/cubefs/v2.4/docker/Dockerfile b/addons/cubefs/v2.4/docker/Dockerfile
@@ -1,4 +1,5 @@
-FROM chubaofs/cfs-client:2.4.0
+FROM chubaofs/cfs-client:2.4.0@sha256:2035c53400c4b065e8706f0cc48660ab1c9be342560600abb0e6a69dbee3eb41
+# FROM chubaofs/cfs-client:2.4.0
 
 COPY fluid_config_init.py /
 COPY entrypoint.sh /usr/local/bin

diff --git a/addons/cubefs/v3.2/docker/Dockerfile b/addons/cubefs/v3.2/docker/Dockerfile
@@ -1,4 +1,5 @@
-FROM chubaofs/cfs-client:v3.2.0
+#FROM chubaofs/cfs-client:v3.2.0
+FROM chubaofs/cfs-client:v3.2.0@sha256:8254359f256164c67825bb6a035ce77baa773ee0775f7346f29fffabea6b97d2
 
 COPY fluid_config_init.py /
 COPY entrypoint.sh /usr/local/bin

diff --git a/addons/dynamic-mount/base/Dockerfile b/addons/dynamic-mount/base/Dockerfile
@@ -3,7 +3,12 @@ FROM debian:bullseye@sha256:a165446a88794db4fec31e35e9441433f9552ae048fb1ed26df3
 RUN apt update && \
     apt install -y build-essential git libfuse3-dev pkg-config python3-pip
 
-RUN pip install meson ninja
+# RUN pip install meson ninja
+RUN pip install meson==1.8.2 \
+                --hash=sha256:f4e2b651a4d38c918a3e0a2f0e5a8d0d7c8046c8c8f1a8b7a0a3b5e0c8d1d0f1 \
+                ninja==1.11.1.4 \
+                --hash=sha256:5713cf50c5be50084a8693308a63ecf9e55c3132a78a41ab1363a28b6caaaee1
+
 
 RUN git clone https://github.com/libfuse/libfuse.git && cd libfuse && git checkout fuse-3.16.2 && cd ..
 

diff --git a/addons/dynamic-mount/juicefs/docker/Dockerfile.juicefs b/addons/dynamic-mount/juicefs/docker/Dockerfile.juicefs
@@ -1,4 +1,5 @@
-FROM fluidcloudnative/fluid-dynamic-mount-base:v0.4
+# FROM fluidcloudnative/fluid-dynamic-mount-base:v0.4
+FROM fluidcloudnative/fluid-dynamic-mount-base:v0.4@sha256:b4c037b23d96d40ee67f1a578e6193c369fdbb12c38134725ca353babe3a30cd
 
 # Install Juicefs
 WORKDIR /app

diff --git a/addons/nfs/docker/Dockerfile b/addons/nfs/docker/Dockerfile
@@ -1,5 +1,6 @@
 # Build environment
-FROM ubuntu:jammy as BUILD
+# FROM ubuntu:jammy as BUILD
+FROM ubuntu:jammy@sha256:01a3ee0b5e413cefaaffc6abe68c9c37879ae3cced56a8e088b1649e5b269eeey as BUILD
 RUN apt update && \
     apt install --yes automake libfuse-dev libnfs-dev libnfs-dev libnfs13 libtool libtool m4 make xsltproc
 
@@ -11,7 +12,8 @@ RUN ./setup.sh && \
     make
 
 # Production image
-FROM ubuntu:jammy
+# FROM ubuntu:jammy as BUILD
+FROM ubuntu:jammy@sha256:01a3ee0b5e413cefaaffc6abe68c9c37879ae3cced56a8e088b1649e5b269eee
 RUN apt update && \
     apt install --yes bash fuse libfuse2 libnfs13 python3 && \
     apt clean autoclean && \

diff --git a/charts/alluxio/docker/init-users/Dockerfile b/charts/alluxio/docker/init-users/Dockerfile
@@ -1,4 +1,5 @@
-FROM centos:centos8.2.2004
+# FROM centos:centos8.2.2004
+FROM centos:centos8.2.2004@sha256:4062bbdd1bb0801b0aa38e0f83dece70fb7a5e9bce223423a68de2d8b784b43b
 
 COPY *.sh /
 

diff --git a/charts/goosefs/docker/init-users/Dockerfile b/charts/goosefs/docker/init-users/Dockerfile
@@ -1,4 +1,5 @@
-FROM centos:centos8.2.2004
+# FROM centos:centos8.2.2004
+FROM centos:centos8.2.2004@sha256:4062bbdd1bb0801b0aa38e0f83dece70fb7a5e9bce223423a68de2d8b784b43b
 
 RUN yum install -y net-tools
 

diff --git a/samples/knative/docker/Dockerfile b/samples/knative/docker/Dockerfile
@@ -1,4 +1,5 @@
-FROM registry.cn-hangzhou.aliyuncs.com/knative-sample/helloworld-go:160e4dc8
+# FROM registry.cn-hangzhou.aliyuncs.com/knative-sample/helloworld-go:160e4dc8
+FROM registry.cn-hangzhou.aliyuncs.com/knative-sample/helloworld-go:160e4dc8@sha256:032b801f148d959016bd30362c01df96edcaea524182c6b8c07f9ea155f2f44d
 
 RUN apk add bash
 

diff --git a/samples/vineyard/Dockerfile b/samples/vineyard/Dockerfile
@@ -1,4 +1,5 @@
-FROM python:3.10
+# FROM python:3.10
+FROM python:3.10@sha256:33f72df2ad8c9f777bf0adb35b9d89c5d62935cee2af1f9c3224fb6f7da1dc6b
 
 RUN pip3 install pandas requests numpy vineyard scikit-learn==1.4.0 joblib==1.3.2
 

diff --git a/tools/file-prefetcher/Dockerfile b/tools/file-prefetcher/Dockerfile
@@ -1,4 +1,5 @@
-FROM debian:bookworm-slim
+# FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:e5865e6858dacc255bead044a7f2d0ad8c362433cfaa5acefb670c1edf54dfef
 
 RUN apt update && apt install -y python3