apiVersion: mutations.gatekeeper.sh/v1beta1
kind: Assign
metadata:
  name: pin-to-digest
spec:
  applyTo:
    - groups: [""]
      kinds: ["Pod"]
      versions: ["v1"]
  match:
    scope: Namespaced
    kinds:
      - apiGroups: ["*"]
        kinds: ["Pod"]
    namespaces: ["test"]
  location: "spec.containers[name: *].image"
  parameters:
    assign:
      externalData:
        provider: attest-provider-mutate
        dataSource: ValueAtLocation
        failurePolicy: Fail