A lockfile for your CI

You already lock your npm packages, Go modules, and Rust crates. But every FROM alpine:latest, every git checkout main is still an unlocked, mutable dependency. A supply chain attack can swap what a tag points to overnight. .dagger/lock pins container image tags, git branches, and HTTP fetches to their resolved values, committed to version control like any other lockfile. Your pipeline either reproduces exactly or fails clearly.

Run --lock=live once to record what every lookup resolves to. Use --lock=pinned in CI to reuse pinned entries and resolve any new lookups. Use --lock=frozen for hardened pipelines: anything not already locked is a hard error, not a silent substitution.

dagger --lock=live call build    # record resolved values
dagger --lock=pinned call build  # reuse pins, resolve new lookups
dagger --lock=frozen call build  # lockfile only, fail on miss
dagger lock update               # refresh all locked entries