chore(deps): pin dependencies

Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>

Author: renovate[bot]

gcb/bootstrap-pgp/cloudbuild.yaml

@@ -4,7 +4,7 @@ steps:
 
 ## Clone & checkout the cert-manager release repository, build cmrel and then
 ## run the bootstrap-pgp command, which will print keys to stdout
-- name: docker.io/library/golang:1.23-alpine
+- name: docker.io/library/golang:1.23-alpine@sha256:383395b794dffa5b53012a212365d40c8e37109a626ca30d6151c8348d380b5f
   entrypoint: sh
   args:
   - -c

gcb/makestage/cloudbuild.yaml

@@ -25,7 +25,7 @@ timeout: 2700s # 45m
 steps:
 # cert-manager relies on the git checkout to determine release version, among other things
 # By default, gcb only does a shallow clone, so we need to "unshallow" to get more details
-- name: gcr.io/cloud-builders/git
+- name: gcr.io/cloud-builders/git@sha256:01005ac2ce42ed9b5929393bbef9fb0cacd4d6ff2d9966874a399273ba6cce3a
   dir: "go/src/github.com/cert-manager/cert-manager"
   entrypoint: bash
   args:

gcb/publish/cloudbuild.yaml

@@ -18,13 +18,13 @@ secrets:
     DOCKER_CONFIG: CiQAPjqeEyZx+aSgFNoW7KQ4wE4hp/9vbWElifjHJNTI0/71ywMSkwIAUOH2xwTfrn72i6p+Op2PYnjDfwMBcInMEtgKAqiTsaup3R5HeL8BsZGuWxVhCEm5CJJ0Rg3CPdFUx2IVmCfC3j32LkAiMxMpszdHTjWHEyWmxwtBlTJW8NFmoYzxfN4Ox9rYFF66eZ0XVdLz1UejXpqAkGFVzTzQSu4rvNFnAsP5Sj7ZKJpXn+p0ZZW1IdMTD0xzCwZjW9hhcTjyNaCKDJYwl8j6Y/bYeoUMrzDQNk48fzKIBgxEdUTR2OOAI785GWSrkB4Y03oEyrfw8jTd1yAoil2S6p3AGV1FbvFleajSCy3Ov+5gjomjtqCbTx06hVsTcqLHC45WzAWPa/8TsiXh5PPgBbkg+pfBQUTj6i9+WA==
 
 steps:
-- name: docker.io/library/golang:1.23-alpine
+- name: docker.io/library/golang:1.23-alpine@sha256:383395b794dffa5b53012a212365d40c8e37109a626ca30d6151c8348d380b5f
   entrypoint: go
   args:
   - install
   - github.com/cert-manager/release/cmd/cmrel@${_RELEASE_REPO_REF}
 
-- name: docker.io/library/golang:1.23-alpine
+- name: docker.io/library/golang:1.23-alpine@sha256:383395b794dffa5b53012a212365d40c8e37109a626ca30d6151c8348d380b5f
   entrypoint: go
   args:
   - install

pkg/release/helm/testdata/cert-manager/values.yaml

@@ -8,7 +8,7 @@ image:
   repository: nginx
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
+  tag: "@sha256:2f4e10193b0c4f61472245e9d26cea78e7df7af266c7e7cf5e67353ee2731b51"
 
 imagePullSecrets: []
 nameOverride: ""