Merge pull request #408 from openstack-k8s-operators/renovate/github-actions-dependencies

Pin dependencies

Author: openshift-merge-bot[bot]

.github/workflows/build-openstack-baremetal-operator.yaml

@@ -43,7 +43,7 @@ jobs:
     if: needs.check-secrets.outputs.have-secrets == 'true'
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: Set latest tag for non main branch
       if: github.ref_name != 'main'
@@ -54,15 +54,15 @@ jobs:
 
     - name: Buildah Action
       id: build-openstack-baremetal-operator-agent
-      uses: redhat-actions/buildah-build@v2
+      uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
       with:
         image: openstack-baremetal-operator-agent
         tags: ${{ env.latesttag }} ${{ github.sha }}
         containerfiles: |
           ./Dockerfile.agent
 
     - name: Push agent To ${{ env.imageregistry }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ steps.build-openstack-baremetal-operator-agent.outputs.image }}
         tags: ${{ steps.build-openstack-baremetal-operator-agent.outputs.tags }}

.github/workflows/codeql.yml

@@ -20,29 +20,29 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
       with:
         languages: ${{ matrix.language }}
         build-mode: autobuild
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
       with:
         category: "/language:${{matrix.language}}"
 
     - name : Run govulncheck
-      uses: golang/govulncheck-action@v1
+      uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1
       with:
           go-version-input: 1.21
           go-package: ./...
           output-file: 'govulncheck.sarif'
           output-format: 'sarif'
 
     - name: Upload SARIF file
-      uses: github/codeql-action/upload-sarif@v3
+      uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
       with:
         sarif_file: govulncheck.sarif

.github/workflows/release-openstack-baremetal-operator.yaml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
     - name: Tag image
-      uses: tinact/docker.image-retag@1.0.2
+      uses: tinact/docker.image-retag@684702232e2a3c29b4e5ca25d7d80f927d255c64 # 1.0.3
       with:
         image_name: ${{ env.imagenamespace }}/
         image_old_tag: ${{ github.sha }}
@@ -28,7 +28,7 @@ jobs:
         registry_password: ${{ secrets.QUAY_PASSWORD }}
 
     - name: Tag -bundle image
-      uses: tinact/docker.image-retag@1.0.2
+      uses: tinact/docker.image-retag@684702232e2a3c29b4e5ca25d7d80f927d255c64 # 1.0.3
       with:
         image_name: ${{ env.imagenamespace }}/-bundle
         image_old_tag: ${{ github.sha }}
@@ -38,7 +38,7 @@ jobs:
         registry_password: ${{ secrets.QUAY_PASSWORD }}
 
     - name: Tag -index image
-      uses: tinact/docker.image-retag@1.0.2
+      uses: tinact/docker.image-retag@684702232e2a3c29b4e5ca25d7d80f927d255c64 # 1.0.3
       with:
         image_name: ${{ env.imagenamespace }}/-index
         image_old_tag: ${{ github.sha }}
@@ -48,7 +48,7 @@ jobs:
         registry_password: ${{ secrets.QUAY_PASSWORD }}
 
     - name: Tag -agent image
-      uses: tinact/docker.image-retag@1.0.2
+      uses: tinact/docker.image-retag@684702232e2a3c29b4e5ca25d7d80f927d255c64 # 1.0.3
       with:
         image_name: ${{ env.imagenamespace }}/-agent
         image_old_tag: ${{ github.sha }}