chore(deps): pin dependencies

.github/workflows/ci.yaml

@@ -18,13 +18,13 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -62,7 +62,7 @@ jobs:
           git tag ${{ steps.full_version.outputs.full_version }}
           git push origin ${{ steps.full_version.outputs.full_version }}
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           push: true
           tags: ghcr.io/usa-reddragon/kiri:${{ steps.tag_name.outputs.tag }}
@@ -79,15 +79,15 @@ jobs:
         run: |
           echo "major_version=${GITHUB_REF#refs/*/}" | sed 's/\.[^.]*$//' | sed 's/\.[^.]*$//' >> $GITHUB_OUTPUT
       - name: Build and push minor version
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'release'
         with:
           push: true
           tags: ghcr.io/usa-reddragon/kiri:${{ steps.minor_version.outputs.minor_version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
       - name: Build and push major version
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'release'
         with:
           push: true
@@ -108,7 +108,7 @@ jobs:
       - name: Create Release
         id: create_release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         with:
@@ -118,7 +118,7 @@ jobs:
           prerelease: false
       - name: Create Issue on Failure
         if: failure() && startsWith(github.ref, 'refs/tags/v')
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/notify.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Send notification
-        uses: USA-RedDragon/telegram-notification@v1.0.0
+        uses: USA-RedDragon/telegram-notification@5c9e380b10cc3af7bd3290a51c3e42485ee2b93f # v1.0.0
         with:
           bot-token: ${{ secrets.TG_BOT_TOKEN }}
           chat-id: ${{ secrets.TG_CHAT_ID }}

.github/workflows/test.yaml

@@ -12,20 +12,20 @@ jobs:
     name: Build and Test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
     # Docker testing
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       with:
         driver: docker
     - name: Log in to GHCR
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.PAT }}
     - name: Build version
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
       with:
         push: true
         tags: ghcr.io/usa-reddragon/kiri-ci:${{ github.sha }}
@@ -34,7 +34,7 @@ jobs:
         sed -i "s#ghcr.io/usa-reddragon/kiri:__KIRI_VERSION__#ghcr.io/usa-reddragon/kiri-ci:${{ github.sha }}#g" action.yml
     # Action testing
     - name: Clone SnekSafe for testing
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         repository: USA-RedDragon/SnekSafe
         path: SnekSafe

Dockerfile

@@ -1,6 +1,6 @@
 
 # Latest stable version of Ubuntu, of course
-FROM ubuntu:24.04
+FROM ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
 
 LABEL org.opencontainers.image.authors "Leandro Heck <leoheck@gmail.com>, Jacob McSwain <kiri-github-action@mcswain.dev>"
 LABEL org.opencontainers.image.description "Kicad 9 and KiRI"
@@ -10,7 +10,7 @@
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG DEBCONF_NOWARNINGS="yes"
 ENV TERM 'dumb'
 
 RUN apt-get update
 RUN apt-get install -y \
@@ -57,11 +57,11 @@
 # Change current user
 USER github
 WORKDIR "/home/github"
 ENV USER github
 ENV HOME /home/github
 ENV DISPLAY :0
 
 ENV PATH "${PATH}:/home/github/.local/bin"
 
 # Python dependencies
 RUN yes | pip3 install \
@@ -103,7 +103,7 @@
 	rm -rf ~/.opam/download-cache ;\
 	rm -rf ~/.opam/repo/*
 
 ENV PATH "${KIRI_HOME}/bin:${KIRI_HOME}/submodules/KiCad-Diff/bin:${PATH}"
 
 # Clean unnecessary stuff
 RUN sudo apt-get purge -y \
@@ -128,17 +128,17 @@
 RUN sudo chmod a+rx /entrypoint.sh
 
 # GitHub Actions environment variables
 ENV KIRI_PROJECT_FILE ""
 ENV KIRI_OUTPUT_DIR ""
 ENV KIRI_REMOVE ""
 ENV KIRI_ARCHIVE ""
 ENV KIRI_PCB_PAGE_FRAME ""
 ENV KIRI_FORCE_LAYOUT_VIEW ""
 ENV KIRI_SKIP_KICAD6_SCHEMATICS ""
 ENV KIRI_SKIP_CACHE ""
 ENV KIRI_OLDER ""
 ENV KIRI_NEWER ""
 ENV KIRI_LAST ""
 ENV KIRI_ALL ""
 
 ENTRYPOINT ["/entrypoint.sh"]

action.yml

@@ -90,7 +90,7 @@ runs:
     with:
       args: ${{ inputs.extra-args }}
   - name: Upload Kiri custom output
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     if: inputs.output-dir != '' && github.event_name == 'pull_request' && github.event.action != 'closed' && steps.kicad-files.outputs.changed == 'true'
     with:
       name: kiri-output
@@ -108,14 +108,14 @@ runs:
         echo "output-dir=$(dirname ${{ inputs.project-file }})/.kiri" >> $GITHUB_OUTPUT
       fi
   - name: Upload Kiri output
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     if: inputs.output-dir == '' && github.event_name == 'pull_request' && github.event.action != 'closed' && steps.kicad-files.outputs.changed == 'true'
     with:
       name: kiri-output
       path: ${{ steps.kiri-output.outputs.output-dir }}
   - name: Checkout gh-pages branch
     if: github.event_name == 'pull_request'
-    uses: actions/checkout@v4
+    uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
     with:
       ref: gh-pages
       fetch-depth: 0
@@ -148,7 +148,7 @@ runs:
       REPO: ${{ github.repository }}
   - name: Create a comment with the link to the output
     if: github.event_name == 'pull_request' && github.event.action != 'closed' && steps.kicad-files.outputs.changed == 'true'
-    uses: peter-evans/create-or-update-comment@v4
+    uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
     with:
       issue-number: ${{ github.event.pull_request.number }}
       body: |
@@ -175,7 +175,7 @@ runs:
       git push origin gh-pages
   - name: Create a comment on the PR
     if: steps.delete.outputs.deleted == 'true' && github.event_name == 'pull_request' && github.event.action == 'closed'
-    uses: peter-evans/create-or-update-comment@v4
+    uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
     with:
       issue-number: ${{ github.event.pull_request.number }}
       body: |