Fix actions permissions

.github/workflows/build-push-charts.yml

@@ -31,10 +31,10 @@ jobs:
 
       - name: Get SemVer version for current commit
         id: semver
-        uses: azimuth-cloud/github-actions/semver@master
+        uses: azimuth-cloud/github-actions/semver@8771cb1c1db134e99becf314f07db6a84b8d7fbf
 
       - name: Publish Helm charts
-        uses: azimuth-cloud/github-actions/helm-publish@master
+        uses: azimuth-cloud/github-actions/helm-publish@8771cb1c1db134e99becf314f07db6a84b8d7fbf
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           version: ${{ steps.semver.outputs.version }}

.github/workflows/build-push-images.yml

@@ -31,19 +31,19 @@ jobs:
           ref: ${{ inputs.ref }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Get SemVer version for current commit
         id: semver
-        uses: azimuth-cloud/github-actions/semver@master
+        uses: azimuth-cloud/github-actions/semver@8771cb1c1db134e99becf314f07db6a84b8d7fbf
 
       - name: Calculate metadata for image
         id: image-meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ghcr.io/stackhpc/azimuth-llm-${{ matrix.component }}-ui
           # Produce the branch name or tag and the SHA as tags
@@ -53,7 +53,7 @@ jobs:
             type=raw,value=${{ steps.semver.outputs.short-sha }}
 
       - name: Build and push image
-        uses: azimuth-cloud/github-actions/docker-multiarch-build-push@master
+        uses: azimuth-cloud/github-actions/docker-multiarch-build-push@8771cb1c1db134e99becf314f07db6a84b8d7fbf
         with:
           cache-key: ${{ matrix.component }}
           context: ./web-apps/

.github/workflows/build-push-vllm-cpu.yml

@@ -30,7 +30,7 @@ jobs:
           ref: ${{ inputs.vllm_ref }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -58,7 +58,7 @@ jobs:
           ref: ${{ inputs.vllm_ref }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/build-push-vllm-xpu.yml

@@ -30,7 +30,7 @@ jobs:
           ref: ${{ inputs.vllm_ref }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/test-pr.yml

@@ -31,6 +31,11 @@ jobs:
     with:
       ref: ${{ github.sha }}
     secrets: inherit
+    permissions:
+      packages: write
+      security-events: write
+      id-token: write
+      contents: read
 
   publish_charts:
     needs: [fail_on_remote]
@@ -84,19 +89,19 @@ jobs:
         working-directory: web-apps
 
       - name: Install Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
 
       - name: Run base chart templating with default values
         run: helm template ci-test charts/azimuth-llm
 
       - name: Set up chart testing
-        uses: helm/chart-testing-action@v2
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
 
       - name: Run chart linting
         run: ct lint --config ct.yaml
 
       - name: Create Kind Cluster
-        uses: helm/kind-action@v1
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
         with:
           cluster_name: ${{ env.CLUSTER_NAME }}
 

.github/workflows/update-dependencies.yml

@@ -61,7 +61,7 @@ jobs:
 
       - name: Create Pull Request
         if: ${{ steps.dependency_updates.outputs.new_vllm_tag }}
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           base: main
           branch: update/vllm-${{ steps.dependency_updates.outputs.new_vllm_tag }}

web-apps/chat/Dockerfile

@@ -1,5 +1,7 @@
 FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim
 
+RUN apt-get update && apt-get install -y libssl3=3.0.19-1~deb12u2 openssl=3.0.19-1~deb12u2 && rm -rf /var/lib/apt/lists/*
+
 ARG DIR=chat
 
 COPY $DIR/requirements.txt requirements.txt