chore(deps): pin dependencies (#254)

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/ci.yaml

@@ -23,18 +23,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
       - name: Log in to the Container registry
         if: ${{ github.ref == 'refs/heads/main' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build test image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
         with:
           context: .
           load: true
@@ -46,7 +46,7 @@ jobs:
           docker run --rm -i --entrypoint python ${{ env.TEST_TAG }} < ci/validate.py
           docker run --rm -i --env=IMAGE --entrypoint python ${{ env.TEST_TAG }} >> "$GITHUB_OUTPUT" < ci/generate_tags.py
       - name: Build images
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.github/workflows/update.yaml

@@ -56,14 +56,14 @@ jobs:
           fi
       - name: Generate Token
         id: generate-token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
         if: ${{ steps.update.outputs.commit-message }}
         with:
           app_id: ${{ secrets.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: Create Pull Request
         id: create-pull-request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7
         if: ${{ steps.update.outputs.commit-message }}
         with:
           token: ${{ steps.generate-token.outputs.token }}
@@ -100,7 +100,7 @@ jobs:
           echo "state=$state" >> "$GITHUB_OUTPUT"
       - name: Generate Token (Approver)
         id: generate-approver-token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
         if: ${{ steps.create-pull-request.outputs.pull-request-number && steps.review.outputs.state != 'APPROVED' }}
         with:
           app_id: ${{ secrets.APPROVER_APP_ID }}