Security / Public reference

Unpinned pipeline image

A GitLab CI, Azure Pipelines, or Cloud Build image or step name that uses latest, or that has no tag and no digest.

What you need to supply

The pipeline text. The pipeline is not executed.

If it reports a finding

Medium severity. The suggested next step is to pin a release tag or an image digest.

What this does not prove

A pinned tag such as node:20 is not this finding. An image named only in a comment is not this finding.

Image that this check is written to notice

image: nginx:latest

All review checks. Reading this page does not submit your infrastructure.