Lock to a specific SHA for chef-pedant