Only access hardening manifests (for source and base images) one time in pipeline