chore(deps): pin dependencies

.github/workflows/build_linux_profiler.yml

@@ -20,7 +20,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -34,7 +34,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false

.github/workflows/build_managed_helper.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -25,7 +25,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages
           path: ./Pyroscope/artifacts/package/release

.github/workflows/build_tracing_packages.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -25,7 +25,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope/Pyroscope.OpenTracing
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages-OpenTracing
           path: ./Pyroscope/artifacts/package/release
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -44,7 +44,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope/Pyroscope.OpenTelemetry
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages-OpenTelemetry
           path: ./Pyroscope/artifacts/package/release

.github/workflows/tag_linux.yml

@@ -22,7 +22,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -59,7 +59,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -96,7 +96,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false

.github/workflows/tag_managed_helper.yml

@@ -18,7 +18,7 @@ jobs:
       RELEASE_VERSION: ${{  github.ref_name }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -29,7 +29,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages
           path: ./Pyroscope/artifacts/package/release

.github/workflows/tag_tracing_opentelemetry_helper.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -24,7 +24,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope/Pyroscope.OpenTelemetry
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages
           path: ./Pyroscope/artifacts/package/release

.github/workflows/tag_tracing_opentracing_helper.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -24,7 +24,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope/Pyroscope.OpenTracing
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages
           path: ./Pyroscope/artifacts/package/release

IntegrationTest/Dockerfile.load-generator

@@ -1,4 +1,4 @@
-FROM python:3.9
+FROM python:3.9@sha256:61c518a24fa2c5e6c2ead2b29bc0c81ff7691d6f36459d2e399d4e25ddc0db38
 
 RUN pip3 install requests
 

Pyroscope.Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:11 AS builder
+FROM debian:11@sha256:5e2b4654ea0dc0bc22434199dace15adf9799f292857679fa79f9395e6d4dafd AS builder
 
 
 RUN apt-get update && apt-get -y install cmake make git curl golang libtool wget
@@ -32,7 +32,7 @@ RUN mkdir build-${CMAKE_BUILD_TYPE} && \
 
 RUN cd build-${CMAKE_BUILD_TYPE} && make -j16 Pyroscope.Profiler.Native Datadog.Linux.ApiWrapper.x64
 
-FROM busybox:1.36.1-glibc
+FROM busybox:1.36.1-glibc@sha256:fea9e0f09e8cbbe7b2d2ca2ebb6e8da1e2e1d7c6ca7a4cf297eb2fcf5afda5ed
 COPY --from=builder /profiler/profiler/_build/DDProf-Deploy/linux/Pyroscope.Profiler.Native.so /Pyroscope.Profiler.Native.so
 COPY --from=builder /profiler/profiler/_build/DDProf-Deploy/linux/Datadog.Linux.ApiWrapper.x64.so /Pyroscope.Linux.ApiWrapper.x64.so
 

Pyroscope.musl.Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.15 AS builder
+FROM alpine:3.15@sha256:19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864 AS builder
 
 RUN apk add  \
             clang \
@@ -40,7 +40,7 @@ RUN mkdir build-${CMAKE_BUILD_TYPE} && \
 
 RUN cd build-${CMAKE_BUILD_TYPE} && make -j16 Pyroscope.Profiler.Native Datadog.Linux.ApiWrapper.x64
 
-FROM busybox:1.36.1-musl
+FROM busybox:1.36.1-musl@sha256:2f9af5cf39068ec3a9e124feceaa11910c511e23a1670dcfdff0bc16793545fb
 COPY --from=builder /profiler/profiler/_build/DDProf-Deploy/linux-musl/Pyroscope.Profiler.Native.so /Pyroscope.Profiler.Native.so
 COPY --from=builder /profiler/profiler/_build/DDProf-Deploy/linux-musl/Datadog.Linux.ApiWrapper.x64.so /Pyroscope.Linux.ApiWrapper.x64.so
 

docker-compose-itest.yml

@@ -1,7 +1,7 @@
 services:
   pyroscope:
     platform: linux/amd64
-    image: grafana/pyroscope
+    image: grafana/pyroscope@sha256:5fba997646c53584799b6beca768dae6358e807020aa98c04cb7db11f0d55681
     ports:
       - "4040:4040"
 
@@ -86,7 +86,7 @@ services:
       SERVICE_NAME: $SERVICE_NAME
 
   grafana:
-    image: grafana/grafana:latest
+    image: grafana/grafana:latest@sha256:35c41e0fd0295f5d0ee5db7e780cf33506abfaf47686196f825364889dee878b
     environment:
       - GF_INSTALL_PLUGINS=grafana-pyroscope-app
       - GF_AUTH_ANONYMOUS_ENABLED=true

docker-compose.serverless.yml

@@ -84,7 +84,7 @@ services:
     - DUMMY_API_HOST=http://serverless-dummy-api:9005
 
   StartDependencies.Serverless:
-    image: andrewlock/wait-for-dependencies
+    image: andrewlock/wait-for-dependencies@sha256:5d87561de8c019c3954298f707c1f6d7087f620a1ce36c3ec38cdfbc1ec4066e
     depends_on:
     - serverless-lambda-no-param-sync
     - serverless-lambda-one-param-sync
@@ -1044,7 +1044,7 @@ services:
 
   # The serverless function calls this API, which always returns 200 OK
   serverless-dummy-api:
-    image: andrewlock/ok-api:latest
+    image: andrewlock/ok-api:latest@sha256:ca0149fef76574b72116add387a1b395e3bafc56cb58b5e45b3c825f742e3911
     ports:
     - "9005:9005"
     environment: