lock down taverna-player to a specific commit