specifying the exact version of the image

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/workflows/build-all.yml

@@ -49,7 +49,7 @@ jobs:
 
   check-size:
     name: Check size
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs:
     - build
 

.github/workflows/build-firmware.yml

@@ -21,9 +21,9 @@ jobs:
 
     name: Build a firmware ${{ inputs.keyboard }}:${{ inputs.keymap }}
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     container:
-      image: ghcr.io/qmk/qmk_cli:latest
+      image: ghcr.io/qmk/qmk_cli@sha256:16c4916e95b99bf88d27b15aec8db409ee17265d1710287fde248c6666508966
 
     steps:
 

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
 
   deploy:
     name: Deploy firmwares
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs:
     - build