From 6e13a5c17dff31be2f06ada8265e20e209fd5a6e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 21 May 2026 14:02:54 +0000
Subject: [PATCH] Pin gcr.io/distroless/static Docker tag to 963fa6c

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index e1c7385..a6d05d7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,7 +29,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 
 # Use distroless as minimal base image to package the binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot AS ocm-kit
+FROM gcr.io/distroless/static:nonroot@sha256:963fa6c544fe5ce420f1f54fb88b6fb01479f054c8056d0f74cc2c6000df5240 AS ocm-kit
 WORKDIR /
 COPY --from=ocm-kit-builder /workspace/bin/ocm-kit .
 USER 65532:65532