doc: always use a ref

README.md

@@ -2,6 +2,10 @@
 This project includes reuseable GitLab-CI jobs for the GitLab Dedicated Project
+## Warning about Refs
+
+It is possible to use these templates without a `ref` tag when including them in your project, but this is not recommended as it may break your build process and make it non-repeatable. For example, if you revert a change, the templates will still reference the latest template which may no longer be compatible. For this reason, it's recommended you always use refs for your templates.
+
 ## CI Jobs
 ### `gitlab-scanners`
@@ -11,8 +15,12 @@ This adds various GitLab SAST, Dependency Scanner, Secret Detection, Licence Sca
 * Default Stage: `validate`
 ```yaml
+stages:
+  - validate
+
 include:
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: 'gitlab-scanners.yml'
 ```
@@ -21,8 +29,12 @@ include:
 * Default Stage: `validate`
 ```yaml
+stages:
+  - validate
+
 include:
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: 'golangci-lint.yml'
 ```
@@ -33,8 +45,12 @@ This job ensures that the repository adheres to the [EditorConfig](https://edito
 * Default Stage: `validate`
 ```yaml
+stages:
+  - validate
+
 include:
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: 'editorconfig-check.yml'
 ```
@@ -70,8 +86,12 @@ You will also need a file called `.releaserc.json` included in your project. Cop
 Next, create a [Project Access Token](https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html) with `api` and `write_repository` scope and make it available in your CI environment via the `GITLAB_TOKEN` environment variable through the CI/CD Variables settings.
 ```yaml
+stages:
+  - release
+
 include:
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: 'semantic-release.yml'
 ```
@@ -153,6 +173,7 @@ variables:
 include:
   # build binary release artifacts with goreleaser
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: goreleaser.yml
 ```
@@ -181,6 +202,7 @@ include:
   # and that ASDF is generally working
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/README.md#asdf-tool-versions
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: asdf-tool-versions.yml
 ```
@@ -213,6 +235,7 @@ include:
   # Runs tflint on all terraform module directories
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: tflint.yml
 ```
@@ -236,6 +259,7 @@ include:
   # Ensures that all terraform files are correctly formatted
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: terraform-format.yml
 ```
@@ -259,6 +283,7 @@ include:
   # Ensures that all terraform files are syntactically valid
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: terraform-validate.yml
 ```
@@ -293,6 +318,7 @@ include:
   # Upgrades dependencies on a schedule
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/README.md#renovate-bot
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: renovate-bot.yml
 ```
@@ -317,5 +343,6 @@ include:
   # Runs Go unit tests
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/README.md#go-unittests
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.11.0 # renovate:managed
     file: go-unittests.yml
 ```