Pin dependencies

.github/workflows/reusable-build-push-container-ghcr.yaml

@@ -36,24 +36,24 @@ jobs:
     env:
       project: src/ProjectOrigin.WalletSystem.Server
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3
 
       - name: Log in to the Container registry if token is set
-        uses: docker/login-action@v3
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3
         if: inputs.push
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5
         with:
           platforms: ${{ inputs.platforms }}
           provenance: false

.github/workflows/reusable-publish-chart.yaml

@@ -25,11 +25,11 @@ jobs:
       HELM_REGISTRY_REPOSITORY: project-origin/helm-registry
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           path: this
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           repository: ${{ inputs.helm_registry_repository }}
           path: helm-registry
@@ -49,12 +49,12 @@ jobs:
           cp helm-releases/index.yaml helm-registry/index.yaml
 
       - name: Upload release assets
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564 # v2
         with:
           files: helm-releases/${{ steps.variables.outputs.name }}-${{ inputs.version }}.tgz
 
       - name: Upload workflow artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
         with:
           path: helm-releases/${{ steps.variables.outputs.name }}-${{ inputs.version }}.tgz
 

.github/workflows/reusable-publish-nuget-artifacts.yaml

@@ -11,7 +11,7 @@ jobs:
       nuget_path: nuget-packages
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3
         with:
           path: ${{ env.nuget_path }}
 

.github/workflows/reusable-sonarcloud.yaml

@@ -11,17 +11,17 @@ jobs:
     name: sonar-analysis
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4
         with:
           distribution: "microsoft"
           java-version: "17"
 
       - name: Setup .NET Core SDK from global.json
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@4d6c8fcf3c8f7a60068d26b594648e99df24cee3 # v4
 
       - name: Build
         shell: bash

.github/workflows/reusable-verify-chart.yaml

@@ -8,7 +8,7 @@ jobs:
     name: Verify chart with local built container
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Start kind cluster
         run: make verify-chart

.github/workflows/reusable-verify-code.yaml

@@ -8,10 +8,10 @@ jobs:
     name: Verifies code formatting, builds, and runs unit tests
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Setup .NET Core SDK from global.json
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@4d6c8fcf3c8f7a60068d26b594648e99df24cee3 # v4
 
       - name: Print info
         run: make info

.github/workflows/reusable-verify-devcontainer.yaml

@@ -8,10 +8,10 @@ jobs:
     name: Verify devcontainer works
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build and run tests on devcontainer
-        uses: devcontainers/[email protected]
+        uses: devcontainers/ci@7957e0cf6d027a8ab027745f399fcdbd3aa74f0f # v0.3
         with:
           push: never
           runCmd: make test

.github/workflows/reusable-verify-renovate.yaml

@@ -8,7 +8,7 @@ jobs:
     name: Verify Renovate config
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Verify Renovate config
         run: npx --yes --package renovate -- renovate-config-validator --strict

.github/workflows/scheduled-renovate.yaml

@@ -11,16 +11,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
-      - uses: tibdex/github-app-token@v2
+      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
         id: get_installation_token
         with:
           app_id: ${{ vars.RENOVATE_GH_APP_ID }}
           private_key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }}
 
       - name: Self-hosted Renovate
-        uses: renovatebot/[email protected]
+        uses: renovatebot/github-action@89bd050bafa5a15de5d9383e3129edf210422004 # v40.1.5
         with:
           configurationFile: .github/renovate-config.json
           token: ${{ steps.get_installation_token.outputs.token }}