From 8ab43d70e94b4b2233f24e5ae7ac747955a3aab2 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 3 Feb 2026 16:27:38 +0000
Subject: [PATCH] chore(deps): pin dependencies

Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
---
 gcb/makestage/cloudbuild.yaml                      | 2 +-
 pkg/release/helm/testdata/cert-manager/values.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gcb/makestage/cloudbuild.yaml b/gcb/makestage/cloudbuild.yaml
index d6f4531..54c1f23 100644
--- a/gcb/makestage/cloudbuild.yaml
+++ b/gcb/makestage/cloudbuild.yaml
@@ -25,7 +25,7 @@ timeout: 2700s # 45m
 steps:
 # cert-manager relies on the git checkout to determine release version, among other things
 # By default, gcb only does a shallow clone, so we need to "unshallow" to get more details
-- name: gcr.io/cloud-builders/git
+- name: gcr.io/cloud-builders/git@sha256:1729e37322627125a813a1ec197e363a6745c149065bc223ba47353307fb5bbe
   dir: "go/src/github.com/cert-manager/cert-manager"
   entrypoint: bash
   args:
diff --git a/pkg/release/helm/testdata/cert-manager/values.yaml b/pkg/release/helm/testdata/cert-manager/values.yaml
index 49c8746..fc92098 100644
--- a/pkg/release/helm/testdata/cert-manager/values.yaml
+++ b/pkg/release/helm/testdata/cert-manager/values.yaml
@@ -8,7 +8,7 @@ image:
   repository: nginx
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
+  tag: "@sha256:9dd288848f4495869f76676e419ae2d767ca99fece2ec37ec0261f9fdaab5204"
 
 imagePullSecrets: []
 nameOverride: ""