Pin dependencies

Author: renovate[bot]

.github/workflows/build-and-push-image.yml

@@ -75,15 +75,15 @@ jobs:
             tag-prefix: "api-"
             aca_name_secret: "ACA_CONTAINERAPP_API_NAME"
     steps:
-      - uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/build@v5.2.1
+      - uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/build@8e72e403f05ff9da09668207eef1d79e1ce9d1a7 # v5.2.1
         with:
           image-name: ${{ needs.set-env.outputs.image-name }}
           build-args: CI=true
           build-file-name: ./Dockerfile.${{ matrix.image }}
           tag-prefix: ${{ matrix.tag-prefix }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/import@v5.2.1
+      - uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/import@8e72e403f05ff9da09668207eef1d79e1ce9d1a7 # v5.2.1
         with:
           image-name: ${{ needs.set-env.outputs.image-name }}
           tag-prefix: ${{ matrix.tag-prefix }}
@@ -100,7 +100,7 @@ jobs:
       - id: annotate
         run: echo "ANNOTATE_RELEASE=${{ matrix.image == 'web' && 'yes' || 'no' }}" >> $GITHUB_ENV
 
-      - uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/deploy@v5.2.1
+      - uses: DFE-Digital/deploy-azure-container-apps-action/.github/actions/deploy@8e72e403f05ff9da09668207eef1d79e1ce9d1a7 # v5.2.1
         with:
           image-name: ${{ needs.set-env.outputs.image-name }}
           tag-prefix: ${{ matrix.tag-prefix }}

.github/workflows/continuous-integration-dotnet.yml

@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0 # Shallow clones disabled for a better relevancy of SC analysis
 
       - name: Setup .NET ${{ env.DOTNET_VERSION }}
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
 

.github/workflows/continuous-integration-terraform.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Terraform Validate
         uses: DFE-Digital/terraform-linting-actions/.github/actions/validate@2608ca06a7f06e1869364c028a8d035d23627acc #v1.2.1

.github/workflows/cypress-tests.yml

@@ -132,7 +132,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.ref }}
 
@@ -210,7 +210,7 @@ jobs:
         run: npm ci --ignore-scripts
 
       - name: Download all test results
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: test-results-*
           path: ${{ env.WORKING_DIRECTORY }}/cypress/reports/mocha
@@ -262,7 +262,7 @@ jobs:
         run: npm ci --ignore-scripts
 
       - name: Download test results
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: test-results-smoke
           path: ${{ env.WORKING_DIRECTORY }}/cypress/reports/mocha

Dfe.ManageFreeSchoolProjects/Dfe.ManageFreeSchoolProjects.CypressTests/package-lock.json

@@ -49,7 +49,7 @@
         "mochawesome-merge": "5.1.1",
         "mochawesome-report-generator": "6.3.2",
         "prettier": "3.8.1",
-        "rimraf": "^6.1.3",
+        "rimraf": "6.1.3",
         "typescript": "5.9.3",
         "typescript-eslint": "^8.57.1",
         "uuid": "13.0.0",

Dfe.ManageFreeSchoolProjects/Dfe.ManageFreeSchoolProjects.CypressTests/package.json

@@ -1,6 +1,6 @@
 services:     
    mfspsqldb:
-    image: mcr.microsoft.com/azure-sql-edge:latest
+    image: mcr.microsoft.com/azure-sql-edge:latest@sha256:902628a8be89e35dfb7895ca31d602974c7bafde4d583a0d0873844feb1c42cf
     environment:
       ACCEPT_EULA: Y
       MSSQL_SA_PASSWORD:  ${DATABASE_PASSWORD}