fix: pin tool versions to avoid GitHub API rate limits

Author: xnoto

tfroot-runner/Containerfile

@@ -39,10 +39,13 @@ RUN apk add --no-cache \
 COPY --from=builder /install /
 
 # Tool versions
+ARG OPENTOFU_VERSION=1.11.5
 ARG SOPS_VERSION=3.11.0
 ARG TERRAFORM_DOCS_VERSION=0.21.0
 ARG TFUPDATE_VERSION=0.9.1
 ARG HCLEDIT_VERSION=0.2.17
+ARG TFLINT_VERSION=0.61.0
+ARG INFRACOST_VERSION=0.10.43
 
 # Install all binary tools in a single layer, strip debug symbols, clean up
 # hadolint ignore=DL3003,DL4006
@@ -52,7 +55,7 @@ RUN set -eux; \
         "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64"; \
     chmod +x /usr/local/bin/sops; \
     # OpenTofu (and symlink as terraform)
-    curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh | sh -s -- --install-method standalone; \
+    curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh | sh -s -- --install-method standalone --opentofu-version "${OPENTOFU_VERSION}"; \
     ln -s /usr/local/bin/tofu /usr/local/bin/terraform; \
     # OpenShift CLI
     curl -L https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/openshift-client-linux.tar.gz | tar xz -C /usr/local/bin oc; \
@@ -73,9 +76,9 @@ RUN set -eux; \
         tar xz -C /usr/local/bin hcledit; \
     chmod +x /usr/local/bin/hcledit; \
     # tflint
-    curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash; \
+    curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | TFLINT_VERSION="v${TFLINT_VERSION}" bash; \
     # infracost
-    curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh; \
+    curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | INFRACOST_VERSION="v${INFRACOST_VERSION}" sh; \
     # Strip debug symbols from all Go/Rust binaries
     strip /usr/local/bin/sops \
           /usr/local/bin/tofu \