Pin dependencies

Author: renovate[bot]

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ jobs:
 
     services:
       db:
-        image: postgres:15.16
+        image: postgres:15.16@sha256:2bc89eed5490967e6b1fa5175d84cb45d65f19fbb8973c7b23450dea785b9505
         # Health checks to wait until postgres has started
         options: >-
           --health-cmd pg_isready
@@ -90,7 +90,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup NodeJS
-        uses: actions/setup-node@v2-beta
+        uses: actions/setup-node@27082cecf3ff7a1742dbd5e12605f0cb59dce2d9 # v2-beta
         with:
           node-version: "20.18"
 

.github/workflows/new-issues.yml

@@ -8,5 +8,5 @@ on:
 
 jobs:
   add-to-hq:
-    uses: mitodl/ol-github-workflows/.github/workflows/add-to-ol-hq.yaml@main
+    uses: mitodl/ol-github-workflows/.github/workflows/add-to-ol-hq.yaml@edd566dec1edd920d35ab1fb60b589cddc44afad # main
     secrets: inherit

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11-slim AS base
+FROM python:3.11-slim@sha256:a5b427ace4900267d93db34138e512325c6fa6af84ad5e4ed5f3b36258cc4142 AS base
 
 LABEL maintainer="ODL DevOps <mitx-devops@mit.edu>"
 
@@ -34,7 +34,7 @@ ENV  \
 ENV PATH="/opt/venv/bin:$PATH"
 
 # Install uv
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:latest@sha256:841c8e6fe30a8b07b4478d12d0c608cba6de66102d29d65d1cc423af86051563 /uv /uvx /usr/local/bin/
 
 COPY pyproject.toml /src
 COPY uv.lock /src

docker-compose.yml

@@ -32,7 +32,7 @@ x-extra-hosts:
 
 services:
   db:
-    image: postgres:15.16
+    image: postgres:15.16@sha256:2bc89eed5490967e6b1fa5175d84cb45d65f19fbb8973c7b23450dea785b9505
     ports:
       - "5432"
     environment:
@@ -177,7 +177,7 @@ services:
       - "8080:8080"
 
   varnish:
-    image: varnish:fresh
+    image: varnish:fresh@sha256:bb507a9c6b769c0bd5c43636ce4856b34bf6c4cdab9eb3f3642691b6c7b046cc
     links:
       - nginx
     ports:
@@ -188,7 +188,7 @@ services:
       - nginx
 
   keycloak:
-    image: quay.io/keycloak/keycloak:latest
+    image: quay.io/keycloak/keycloak:latest@sha256:dea26401d06341095cc4ea9d66896200b55de5ca1daa1d2fcbe58493afa6e0ad
     profiles:
       - keycloak
     depends_on:
@@ -216,7 +216,7 @@ services:
       - ./config/keycloak/realms:/opt/keycloak/data/import
 
   api:
-    image: apache/apisix:latest
+    image: apache/apisix:latest@sha256:468a384f8b9236a904dd65a19fc3eab9492ea98d0054b69e840e04e529120dcd
     profiles:
       - apisix
     environment:
@@ -238,13 +238,13 @@ services:
   coordinator:
     profiles:
       - verifiable-creds
-    image: digitalcredentials/issuer-coordinator:1.0.0
+    image: digitalcredentials/issuer-coordinator:1.0.0@sha256:8610376d4c35420e1c780f90c9b6402ebcfa965ee0e67383493dde31afa95a91
     ports:
       - "4005:4005"
   signer:
     profiles:
       - verifiable-creds
-    image: digitalcredentials/signing-service:1.2.0
+    image: digitalcredentials/signing-service:1.2.0@sha256:2a2e2fe4f4782b5c62783fc06d8b3931e95f3873779df34a2aa441545eaa3446
 
 
 volumes: