chore(deps): pin dependencies (#308)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Om Mishra <32200996+mishraomp@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/.deploy.yml

@@ -81,7 +81,7 @@ jobs:
       triggered: ${{ steps.deploy.outputs.triggered }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-      - uses: bcgov/action-crunchy@v1.1.0
+      - uses: bcgov/action-crunchy@4e2f04920b36c4e92f19489f8cb0ce8580596ac3 # v1.2.0
         name: Deploy Crunchy
         id: deploy_crunchy
         with:
@@ -120,7 +120,7 @@ jobs:
 
       - name: Stop pre-existing deployments on PRs (status = pending-upgrade)
         if: github.event_name == 'pull_request'
-        uses: bcgov/action-oc-runner@8ae8e22ccc644c73041a3b3ca3f2e6afdddad845 # v1.2.1
+        uses: bcgov/action-oc-runner@12997e908fba505079d1aab6f694a17fe15e9b28 # v1.2.2
         with:
           oc_namespace: ${{ secrets.oc_namespace }}
           oc_token: ${{ secrets.oc_token }}
@@ -141,7 +141,7 @@ jobs:
         run: ls -l charts/crunchy/values.yml
       - name: Helm Deploy
         id: deploy
-        uses: bcgov/action-oc-runner@8ae8e22ccc644c73041a3b3ca3f2e6afdddad845 # v1.2.1
+        uses: bcgov/action-oc-runner@12997e908fba505079d1aab6f694a17fe15e9b28 # v1.2.2
         with:
           oc_namespace: ${{ secrets.oc_namespace }}
           oc_token: ${{ secrets.oc_token }}

.github/workflows/analysis.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # 0.30.0
         with:
           format: "sarif"
           output: "trivy-results.sarif"
@@ -108,7 +108,7 @@ jobs:
           path: ~/.local
           key: poetry-${{ hashFiles('**/pyproject.toml') }}
 
-      - uses: snok/install-poetry@v1.4.1
+      - uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1.4.1
         with:
           version: 1.2.2
           virtualenvs-create: true

.github/workflows/merge.yml

@@ -33,7 +33,7 @@ jobs:
     steps: # Get PR number for squash merges to main
       - name: PR Number
         id: pr
-        uses: bcgov/action-get-pr@v0.0.1
+        uses: bcgov/action-get-pr@21f9351425cd55a98e869ee28919a512aa30647d # v0.0.1
   deploy-test:
     name: Deploy (TEST)
     uses: ./.github/workflows/.deploy.yml
@@ -116,7 +116,7 @@ jobs:
         package: [backend-go, backend-py, backend-java, migrations-go, migrations-py]
     timeout-minutes: 1
     steps:
-      - uses: shrink/actions-docker-registry-tag@v4
+      - uses: shrink/actions-docker-registry-tag@f04afd0559f66b288586792eb150f45136a927fa # v4
         with:
           registry: ghcr.io
           repository: ${{ github.repository }}/${{ matrix.package }}

.github/workflows/pentests.yml

@@ -20,7 +20,7 @@ jobs:
         name: [backendGo, backendJava, backendPy]
     steps:
       - name: ZAP Scan
-        uses: zaproxy/action-full-scan@v0.12.0
+        uses: zaproxy/action-full-scan@75ee1686750ab1511a73b26b77a2aedd295053ed # v0.12.0
         with:
           allow_issue_writing: true
           artifact_name: "zap_${{ matrix.name }}"

.github/workflows/pr-close.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   cleanup:
     name: Cleanup OpenShift and/or Promote Images
-    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-close.yml@v0.9.0
+    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-close.yml@0b8121a528aaa05ef8def2f79be9081691dfe98a # v0.9.0
     secrets:
       oc_namespace: ${{ vars.OC_NAMESPACE }}
       oc_token: ${{ secrets.OC_TOKEN }}
@@ -24,7 +24,7 @@ jobs:
     name: Remove DB User from Crunchy
     runs-on: ubuntu-24.04
     steps:
-      - uses: bcgov/action-crunchy@v1.1.0
+      - uses: bcgov/action-crunchy@4e2f04920b36c4e92f19489f8cb0ce8580596ac3 # v1.2.0
         name: Remove PR Specific User
         with:
           oc_namespace: ${{ vars.oc_namespace }}

.github/workflows/pr-validate.yml

@@ -11,7 +11,7 @@ concurrency:
 jobs:
   validate:
     name: Validate PR
-    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-validate.yml@v0.9.0
+    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-validate.yml@0b8121a528aaa05ef8def2f79be9081691dfe98a # v0.9.0
     with:
       markdown_links: |
         - [Java](https://${{ github.event.repository.name }}-${{ github.event.number }}-backendJava.apps.silver.devops.gov.bc.ca)