chore(deps): pin dependencies (#1)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/actionlint.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     name: lint github workflows
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
       - name: Add problem matchers
         run: |
           # https://github.com/rhysd/actionlint/blob/3a2f2c7/docs/usage.md#problem-matchers

.github/workflows/auto-assign-pr.yaml

@@ -9,4 +9,4 @@ jobs:
   auto-assign:
     runs-on: ubuntu-latest
     steps:
-      - uses: kentaro-m/[email protected]
+      - uses: kentaro-m/auto-assign-action@f4648c0a9fdb753479e9e75fc251f507ce17bb7e # v2.0.0

.github/workflows/conventional-commits.yaml

@@ -13,4 +13,4 @@ jobs:
           fetch-depth: 0
 
       - name: Conventional commits check
-        uses: oknozor/cocogitto-action@v3
+        uses: oknozor/cocogitto-action@5464e067eeb18b4b9af30eee1ecf2c45f1afc900 # v3

.github/workflows/create-release-prs.yaml

@@ -12,14 +12,14 @@ jobs:
   createReleasePR:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@f3969c04a4ec81d7a9aa4010d84ae6a7602f86a7 # v4
         with:
           skip-github-release: true
           token: ${{ secrets.ACTIONS_BOT_TOKEN }}
           config-file: .github/release-please/config.json
           manifest-file: .github/release-please/manifest.json
         id: release-please
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
         if: ${{ steps.release-please.outputs.prs_created == 'true' }}
       - name: Set PRs to auto-merge
         if: ${{ steps.release-please.outputs.prs_created == 'true' }}

.github/workflows/release-image.yaml

@@ -18,7 +18,7 @@ jobs:
       releases_created: ${{ steps.release.outputs.releases_created }}
       paths_released: ${{ steps.release.outputs.paths_released }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@f3969c04a4ec81d7a9aa4010d84ae6a7602f86a7 # v4
         id: release
         with:
           skip-github-pull-request: true
@@ -44,7 +44,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
       - name: Detect changes
-        uses: dorny/[email protected]
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
           filters: |
@@ -59,7 +59,7 @@ jobs:
         id: get-image-version
         run: echo "version=$(jq -r '."${{ matrix.image }}"' < .github/release-please/manifest.json)" >> "$GITHUB_OUTPUT"
       - name: Docker Metadata
-        uses: docker/[email protected]
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
         id: meta
         with:
           images: ${{ format('{0}/{1}/{2}', env.REGISTRY ,'teutonet/oci-images', steps.get-image-name.outputs.fragment ) }}
@@ -71,18 +71,18 @@ jobs:
             type=semver,pattern={{version}},value=${{ steps.get-image-version.outputs.version }}
             type=sha,prefix=
       - name: Set up QEMU
-        uses: docker/[email protected]
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
       - name: Set up Docker BuildX
-        uses: docker/[email protected]
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
         id: push
-        uses: docker/[email protected]
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
         with:
           context: ${{ matrix.image }}
           platforms: ${{ matrix.platform }}

.github/workflows/update-codeowners.yaml

@@ -12,14 +12,14 @@ jobs:
   generateCodeowners:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
 
       - name: generate CODEOWNERS
         run: ./.github/scripts/sync-codeowners.sh > .github/CODEOWNERS
 
       - name: Create PR
         id: create-pr
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6
         with:
           add-paths: |
             .github/CODEOWNERS

images/ckan-dcatapde/Dockerfile

@@ -1,4 +1,4 @@
-FROM ckan/ckan-base:2.10.4
+FROM ckan/ckan-base:2.10.4@sha256:bc4b3a09f9b11fbcd143603ada36c0b6309d0b1fce86fd895e71714d5de405fa
 
 # Install any extensions needed by your CKAN instance
 # See Dockerfile.dev for more details and examples

images/ckan/Dockerfile

@@ -1,4 +1,4 @@
-FROM ckan/ckan-base:2.10.4
+FROM ckan/ckan-base:2.10.4@sha256:bc4b3a09f9b11fbcd143603ada36c0b6309d0b1fce86fd895e71714d5de405fa
 
 # Install any extensions needed by your CKAN instance
 # See Dockerfile.dev for more details and examples

images/solr-ckan/Dockerfile

@@ -1,4 +1,4 @@
-FROM bitnami/solr:9
+FROM bitnami/solr:9@sha256:01bc894ef76da758f154066750fd13370bb288c9d4c8e0236eddeb0cb039d3c6
 
 EXPOSE 8983