Investigate a method for versioning builders

[jthegedus]

I don't want to use the latest tag exclusively in case of a bad update. What methods could be used to version these?

[dbrtly]

Should the custom-builders.yaml file include a sha256 key with value matching a specific commit?

[jthegedus]

Yes, I think that would be the ideal method. Should probably also support a "major" version as has become the trend with GitHub Actions, so people can use builder@1 and automatically get the latest for that major version... not sure.

It becomes a question of ease-of-use vs what is the most secure. Given no dependabot support, a builder which runs and checks builder versions would also be useful. Or just get https://github.com/sethvargo/ratchet to support meta-builders (if it even needs changes to 🤔)

What I described above are called "versioned" (sha) and "unversioned" (major semver #) in Ratchet - https://github.com/sethvargo/ratchet#terminology