message: ci: pin docker images by ID for hermeticity
diff: # needed for jobs that run tests without Bazel. Bazel runs tests with browsers that will be
  # fetched by the Webtesting rules. Therefore for jobs that run tests with Bazel, we don't need a
  # docker image with browsers pre-installed.
  -# **NOTE**: If you change the the version of the docker images, also change the `cache_key` suffix.
  -var_1: &docker_image circleci/node:10.16-browsers
  +# **NOTE 1**: Pin to exact images using an ID (SHA). See https://circleci.com/docs/2.0/circleci-images/#using-a-docker-image-id-to-pin-an-image-to-a-fixed-version.
  +# (Using the tag in not necessary when pinning by ID, but include it anyway for documentation purposes.)
  +# **NOTE 2**: If you change the version of the docker images, also change the `cache_key` suffix.
  +var_1: &docker_image circleci/node:10.16-browsers@sha256:d2a96fe1cbef51257ee626b5f645e64dade3e886f00ba9cb7e8ea65b4efe8db1
  var_2: &cache_key v2-nguniversal-{{ .Branch }}-{{ checksum "yarn.lock" }}-node-10.16
  # Settings common to each job
  