chore(deps): pin dependencies

renovate-sh-app[bot] · web-flow · commit 9d89b85c5f93 · 2026-01-13T05:32:03.000Z
Signed-off-by: renovate-sh-app[bot] &lt;219655108+renovate-sh-app[bot]@users.noreply.github.com&gt;
diff --git a/.github/workflows/example_basic_test.yaml b/.github/workflows/example_basic_test.yaml
@@ -8,7 +8,7 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:0.15.19 # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
diff --git a/.github/workflows/example_browser_test.yaml b/.github/workflows/example_browser_test.yaml
@@ -8,7 +8,7 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:0.15.19 # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
diff --git a/.github/workflows/example_cli_flags_test.yaml b/.github/workflows/example_cli_flags_test.yaml
@@ -8,7 +8,7 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:0.15.19 # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
diff --git a/.github/workflows/example_env_var.yaml b/.github/workflows/example_env_var.yaml
@@ -8,7 +8,7 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:0.15.19 # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde # zizmor: ignore[unpinned-images]
         ports:
           - 3355:3333
 
diff --git a/.github/workflows/example_specific_k6_version.yaml b/.github/workflows/example_specific_k6_version.yaml
@@ -8,7 +8,7 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:0.15.19 # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
diff --git a/.github/workflows/example_verify_scripts.yaml b/.github/workflows/example_verify_scripts.yaml
@@ -8,7 +8,7 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:0.15.19 # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
diff --git a/.github/workflows/k6_browser_tests.yaml b/.github/workflows/k6_browser_tests.yaml
@@ -8,7 +8,7 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:0.15.19 # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
diff --git a/.github/workflows/k6_tests.yaml b/.github/workflows/k6_tests.yaml
@@ -8,7 +8,7 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:0.15.19 # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
diff --git a/compose.grafana-cloud.microservices.yaml b/compose.grafana-cloud.microservices.yaml
@@ -12,7 +12,7 @@ x-quickpizza-env-common: &quickpizza-env-common
 name: quickpizza
 services:
   alloy:
-    image: grafana/alloy:v1.12.0
+    image: grafana/alloy:v1.12.0@sha256:85e4a706181741dd735d9a69bea81f9e03e16d5349bff46dd9640379f143c007
     container_name: alloy
     labels:
       - "service.type=instrumentation"
@@ -47,7 +47,7 @@ services:
       - ws
 
   catalog:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: catalog
     labels:
       - "service.type=application"
@@ -67,7 +67,7 @@ services:
         condition: service_healthy
 
   config:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: config
     labels:
       - "service.type=application"
@@ -82,7 +82,7 @@ services:
       QUICKPIZZA_CONF_FARO_APP_NAME: "${QUICKPIZZA_CONF_FARO_APP_NAME:-QuickPizza}"
       QUICKPIZZA_CONF_FARO_INSTRUMENTATION_ENABLE_REPLAY: "${QUICKPIZZA_CONF_FARO_INSTRUMENTATION_ENABLE_REPLAY:-false}"
   copy:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: copy
     labels:
       - "service.type=application"
@@ -104,7 +104,7 @@ services:
         condition: service_started
 
   public-api:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: public-api
     labels:
       - "service.type=application"
@@ -118,7 +118,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "public-api"
 
   recommendations:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: recommendations
     labels:
       - "service.type=application"
@@ -130,7 +130,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "recommendations"
 
   ws:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: ws
     labels:
       - "service.type=application"
@@ -142,7 +142,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "ws"
 
   quickpizza-db:
-    image: postgres:18.1
+    image: postgres:18.1@sha256:0a9d07c16184b6bf34cb405ddf22eb312da2fc1ef6639e62434a500587675f79
     container_name: quickpizza-db
     labels:
       - "service.type=database"
diff --git a/compose.grafana-cloud.monolithic.yaml b/compose.grafana-cloud.monolithic.yaml
@@ -1,6 +1,6 @@
 services:
   alloy:
-    image: grafana/alloy:v1.12.0
+    image: grafana/alloy:v1.12.0@sha256:85e4a706181741dd735d9a69bea81f9e03e16d5349bff46dd9640379f143c007
     container_name: alloy
     labels:
       - "service.type=instrumentation"
@@ -31,7 +31,7 @@ services:
   quickpizza:
     # The QUICKPIZZA_IMAGE env. variable enables the use of a locally built image,
     # created with `make docker-build`.
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     # Alloy reads `container_name` to relabel service name in telemetry.
     container_name: quickpizza
     labels:
@@ -60,7 +60,7 @@ services:
         condition: service_healthy
 
   quickpizza-db:
-    image: postgres:18.1
+    image: postgres:18.1@sha256:0a9d07c16184b6bf34cb405ddf22eb312da2fc1ef6639e62434a500587675f79
     container_name: quickpizza-db
     labels:
       - "service.type=database"
diff --git a/compose.grafana-local-stack.microservices.yaml b/compose.grafana-local-stack.microservices.yaml
@@ -12,7 +12,7 @@ x-quickpizza-env-common: &quickpizza-env-common
 name: quickpizza
 services:
   alloy:
-    image: grafana/alloy:v1.12.0
+    image: grafana/alloy:v1.12.0@sha256:85e4a706181741dd735d9a69bea81f9e03e16d5349bff46dd9640379f143c007
     container_name: alloy
     labels:
       - "service.type=instrumentation"
@@ -51,7 +51,7 @@ services:
       - ws
 
   catalog:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: catalog
     labels:
       - "service.type=application"
@@ -68,7 +68,7 @@ services:
         condition: service_healthy
 
   config:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: config
     labels:
       - "service.type=application"
@@ -79,7 +79,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_INSTANCE_ID: "config"
       QUICKPIZZA_OTEL_SERVICE_NAME: "config"
   copy:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: copy
     labels:
       - "service.type=application"
@@ -98,7 +98,7 @@ services:
         condition: service_started
 
   public-api:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: public-api
     labels:
       - "service.type=application"
@@ -112,7 +112,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "public-api"
 
   recommendations:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: recommendations
     labels:
       - "service.type=application"
@@ -124,7 +124,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "recommendations"
 
   ws:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: ws
     labels:
       - "service.type=application"
@@ -136,7 +136,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "ws"
 
   quickpizza-db:
-    image: postgres:18.1
+    image: postgres:18.1@sha256:0a9d07c16184b6bf34cb405ddf22eb312da2fc1ef6639e62434a500587675f79
     container_name: quickpizza-db
     labels:
       - "service.type=database"
@@ -156,15 +156,15 @@ services:
       retries: 5
 
   loki:
-    image: grafana/loki:3.4.3
+    image: grafana/loki:3.4.3@sha256:5fe9fa99e9a747297cdf0239a5b25d192d8f668bd6505b09beef4dffcab5aac2
     container_name: loki
     labels:
       - "service.type=instrumentation"
     ports:
       - "3100:3100"
 
   prometheus:
-    image: prom/prometheus:v3.2.1
+    image: prom/prometheus:v3.2.1@sha256:6927e0919a144aa7616fd0137d4816816d42f6b816de3af269ab065250859a62
     container_name: prometheus
     labels:
       - "service.type=instrumentation"
@@ -177,15 +177,15 @@ services:
       - "9090:9090"
 
   pyroscope:
-    image: grafana/pyroscope:1.16.0
+    image: grafana/pyroscope:1.16.0@sha256:58e49fa3443195c7b95f5c9821ce8920a8627f215c2ccdf955a9cd78c76a3468
     container_name: pyroscope
     labels:
       - "service.type=instrumentation"
     ports:
       - "4040:4040"
 
   tempo:
-    image: grafana/tempo:2.9.0
+    image: grafana/tempo:2.9.0@sha256:65a5789759435f1ef696f1953258b9bbdb18eb571d5ce711ff812d2e128288a4
     container_name: tempo
     labels:
       - "service.type=instrumentation"
diff --git a/compose.grafana-local-stack.monolithic.yaml b/compose.grafana-local-stack.monolithic.yaml
@@ -1,6 +1,6 @@
 services:
   alloy:
-    image: grafana/alloy:v1.12.0
+    image: grafana/alloy:v1.12.0@sha256:85e4a706181741dd735d9a69bea81f9e03e16d5349bff46dd9640379f143c007
     container_name: alloy
     labels:
       - "service.type=instrumentation"
@@ -36,7 +36,7 @@ services:
   quickpizza:
     # The QUICKPIZZA_IMAGE env. variable enables the use of a locally built image,
     # created with `make docker-build`.
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:0.15.19@sha256:9bb274e6178bfccc8da2f7d28dd65285fd6f6f8fd9d006febec65c7da655cfde}
     container_name: quickpizza
     labels:
       - "service.type=application"
@@ -59,7 +59,7 @@ services:
         condition: service_healthy
 
   quickpizza-db:
-    image: postgres:18.1
+    image: postgres:18.1@sha256:0a9d07c16184b6bf34cb405ddf22eb312da2fc1ef6639e62434a500587675f79
     container_name: quickpizza-db
     labels:
       - "service.type=database"
@@ -79,15 +79,15 @@ services:
       retries: 5
 
   loki:
-    image: grafana/loki:3.4.3
+    image: grafana/loki:3.4.3@sha256:5fe9fa99e9a747297cdf0239a5b25d192d8f668bd6505b09beef4dffcab5aac2
     container_name: loki
     labels:
       - "service.type=instrumentation"
     ports:
       - "3100:3100"
 
   prometheus:
-    image: prom/prometheus:v3.2.1
+    image: prom/prometheus:v3.2.1@sha256:6927e0919a144aa7616fd0137d4816816d42f6b816de3af269ab065250859a62
     container_name: prometheus
     labels:
       - "service.type=instrumentation"
@@ -108,7 +108,7 @@ services:
       - "4040:4040"
 
   tempo:
-    image: grafana/tempo:2.9.0
+    image: grafana/tempo:2.9.0@sha256:65a5789759435f1ef696f1953258b9bbdb18eb571d5ce711ff812d2e128288a4
     container_name: tempo
     labels:
       - "service.type=instrumentation"
diff --git a/deployments/terraform/alloy.tf b/deployments/terraform/alloy.tf
@@ -85,7 +85,7 @@ resource "kubernetes_deployment_v1" "alloy" {
         service_account_name = kubernetes_service_account_v1.alloy.metadata[0].name
         container {
           name              = "alloy"
-          image             = "grafana/alloy:v1.12.0"
+          image             = "grafana/alloy:v1.12.0@sha256:85e4a706181741dd735d9a69bea81f9e03e16d5349bff46dd9640379f143c007"
           image_pull_policy = "IfNotPresent"
           args = [
             "run",
diff --git a/deployments/terraform/database.tf b/deployments/terraform/database.tf
@@ -61,7 +61,7 @@ resource "kubernetes_stateful_set_v1" "postgres_statefulset" {
       }
       spec {
         container {
-          image = "postgres:18"
+          image = "postgres:18@sha256:0a9d07c16184b6bf34cb405ddf22eb312da2fc1ef6639e62434a500587675f79"
           name  = "postgres"
           
           args = [
