From 2b0eb923243c0bb04be2cb93bf1537d93e31406c Mon Sep 17 00:00:00 2001
From: Paul Fournillon <paul.fournillon@datadoghq.com>
Date: Wed, 22 Jul 2026 15:21:42 +0200
Subject: [PATCH] chore: fix ci images tags

---
 .gitlab-ci.yml                         | 6 +++---
 .gitlab/build-deploy/.gitlab-ci.yml    | 6 +++---
 .gitlab/jdk-integration/.gitlab-ci.yml | 2 +-
 .gitlab/reliability/.gitlab-ci.yml     | 4 ++--
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2946b379ce..d7f1eb81ee 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,8 +1,8 @@
-image: alpine
+image: alpine:3.22.1@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
 
 variables:
   REGISTRY: registry.ddbuild.io
-  PREPARE_IMAGE: registry.ddbuild.io/images/benchmarking-platform-tools-ubuntu:latest
+  PREPARE_IMAGE: registry.ddbuild.io/images/benchmarking-platform-tools-ubuntu:b1a4215d@sha256:af19410c9f2d92c89bbef5c937c5bab527eb6fbdd04d506d626c3cc722ff07ea
   # Image with dd-octo-sts for GitHub token exchange (check-image-updates, rebuild-images-pr)
   DD_OCTO_STS_IMAGE: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
   FORCE_BUILD:
@@ -180,7 +180,7 @@ generate-reliability-child-pipeline:
       else
         cat > generated-reliability.yml << 'NOOP'
       skip-reliability:
-        image: registry.ddbuild.io/images/benchmarking-platform-tools-ubuntu:latest
+        image: $PREPARE_IMAGE
         tags: ["arch:amd64"]
         script:
           - echo "Label test:reliability not set — skipping"
diff --git a/.gitlab/build-deploy/.gitlab-ci.yml b/.gitlab/build-deploy/.gitlab-ci.yml
index 7845952d43..1d96d52390 100644
--- a/.gitlab/build-deploy/.gitlab-ci.yml
+++ b/.gitlab/build-deploy/.gitlab-ci.yml
@@ -1,4 +1,4 @@
-image: alpine
+image: alpine:3.22.1@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
 
 variables:
   # Generated by https://gitlab.ddbuild.io/DataDog/java-profiler/-/jobs/1600939090
@@ -346,7 +346,7 @@ notify-slack-on-success:
     - job: deploy-artifact
       artifacts: false
   when: on_success
-  image: registry.ddbuild.io/slack-notifier:latest
+  image: registry.ddbuild.io/slack-notifier:v91289620-4ec922a-latest@sha256:06b24f392ccc383d371c72001520a254edef523bc0bfdc445f487106107b4202
   tags: ["arch:amd64"]
   script:
     - .gitlab/build-deploy/notify_channel.sh success $(cat version.txt)
@@ -360,7 +360,7 @@ notify-slack-on-failure:
     - job: deploy-artifact
       artifacts: true
   when: on_failure
-  image: registry.ddbuild.io/slack-notifier:latest
+  image: registry.ddbuild.io/slack-notifier:v91289620-4ec922a-latest@sha256:06b24f392ccc383d371c72001520a254edef523bc0bfdc445f487106107b4202
   tags: ["arch:amd64"]
   script:
     - .gitlab/build-deploy/notify_channel.sh alert $(cat version.txt)
diff --git a/.gitlab/jdk-integration/.gitlab-ci.yml b/.gitlab/jdk-integration/.gitlab-ci.yml
index 4fe94b90fd..81fde8867c 100644
--- a/.gitlab/jdk-integration/.gitlab-ci.yml
+++ b/.gitlab/jdk-integration/.gitlab-ci.yml
@@ -47,7 +47,7 @@ test-with-jdk:
 notify-slack:
   stage: notify
   when: on_failure
-  image: registry.ddbuild.io/slack-notifier:latest
+  image: registry.ddbuild.io/slack-notifier:v91289620-4ec922a-latest@sha256:06b24f392ccc383d371c72001520a254edef523bc0bfdc445f487106107b4202
   tags: ["arch:amd64"]
   script:
     - .gitlab/jdk-integration/notify_channel.sh "${JDK_VERSION}" "${DEBUG_LEVEL}" "${HASH}"
diff --git a/.gitlab/reliability/.gitlab-ci.yml b/.gitlab/reliability/.gitlab-ci.yml
index 45b6a9d049..45e462628f 100644
--- a/.gitlab/reliability/.gitlab-ci.yml
+++ b/.gitlab/reliability/.gitlab-ci.yml
@@ -1,5 +1,5 @@
 variables:
-  PREPARE_IMAGE: registry.ddbuild.io/images/benchmarking-platform-tools-ubuntu:latest
+  PREPARE_IMAGE: registry.ddbuild.io/images/benchmarking-platform-tools-ubuntu:b1a4215d@sha256:af19410c9f2d92c89bbef5c937c5bab527eb6fbdd04d506d626c3cc722ff07ea
   DD_OCTO_STS_IMAGE: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
 
 # Shared template — concrete jobs supply image, tags, and ARCH variable
@@ -121,7 +121,7 @@ notify-slack:
     - if: '$CI_PIPELINE_SOURCE == "schedule"'
       when: on_failure
     - when: never
-  image: registry.ddbuild.io/slack-notifier:latest
+  image: registry.ddbuild.io/slack-notifier:v91289620-4ec922a-latest@sha256:06b24f392ccc383d371c72001520a254edef523bc0bfdc445f487106107b4202
   tags: [ "arch:amd64" ]
   needs:
     - get-versions