Pin dependencies

.gitea/workflows/build-java.yml

@@ -13,17 +13,17 @@ jobs:
       matrix:
         java_version: [21]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Login to Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ${{ vars.REGISTRY_URL }}
         username: ${{ secrets.REGISTRY_USER }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
 
     - name: Build and Push
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
       with:
         context: .
         file: java/Dockerfile.java${{ matrix.java_version }}

.gitea/workflows/build-php.yml

@@ -13,17 +13,17 @@ jobs:
       matrix:
         php_version: [82, 84]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Login to Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ${{ vars.REGISTRY_URL }}
         username: ${{ secrets.REGISTRY_USER }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
 
     - name: Build and Push
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
       with:
         context: .
         file: php/Dockerfile.php${{ matrix.php_version }}

.gitea/workflows/build-python.yml

@@ -10,17 +10,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Login to Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ${{ vars.REGISTRY_URL }}
         username: ${{ secrets.REGISTRY_USER }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
 
     - name: Build and Push
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
       with:
         context: .
         file: python/Dockerfile.python3

java/Dockerfile.java21

@@ -1,4 +1,4 @@
-FROM gitea.bobert.me/anthorob/coder-base:latest
+FROM gitea.bobert.me/anthorob/coder-base:latest@sha256:d8798445dc360f06265118818d0e237e03d4bfdf6c07fee7244d7588d019c3b4
 
 USER root
 

php/Dockerfile.php82

@@ -1,4 +1,4 @@
-FROM gitea.bobert.me/anthorob/coder-base:latest
+FROM gitea.bobert.me/anthorob/coder-base:latest@sha256:d8798445dc360f06265118818d0e237e03d4bfdf6c07fee7244d7588d019c3b4
 
 USER root
 

php/Dockerfile.php84

@@ -1,4 +1,4 @@
-FROM gitea.bobert.me/anthorob/coder-base:latest
+FROM gitea.bobert.me/anthorob/coder-base:latest@sha256:d8798445dc360f06265118818d0e237e03d4bfdf6c07fee7244d7588d019c3b4
 
 USER root
 

python/Dockerfile.python3

@@ -1,4 +1,4 @@
-FROM gitea.bobert.me/anthorob/coder-base:latest
+FROM gitea.bobert.me/anthorob/coder-base:latest@sha256:d8798445dc360f06265118818d0e237e03d4bfdf6c07fee7244d7588d019c3b4
 
 USER root