Merge branch 'renovate/pin-dependencies' into 'master'

Author: ildoc

.github/workflows/gh-pages.yml

@@ -11,16 +11,16 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
         with:
           python-version: 3.x
       - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           key: mkdocs-material-${{ env.cache_id }}
           path: .cache

.gitlab/ci/opentofu.yml

@@ -31,7 +31,7 @@ cache:
 
 # Configurazione di base per i job OpenTofu
 .tofu_base:
-  image: alpine:3.22
+  image: alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
   extends:
     - .rules_opentofu
   before_script: |

.gitlab/ci/templates/update_service_ansible.yml

@@ -2,7 +2,7 @@
 .update_service_template:
   stage: update_services
   image:
-    name: registry.gitlab.local.ildoc.it/devops/ansible-vault:92eaccbb67b7fa59dce7de1a69887132bee8fe51
+    name: registry.gitlab.local.ildoc.it/devops/ansible-vault:92eaccbb67b7fa59dce7de1a69887132bee8fe51@sha256:c5116540bee56dc7925948fbc69fc9a027ae519197419d48e41f5abccab440f4
     entrypoint: [""]
   extends:
     - .ssh_setup

ansible/roles/gitlab/files/docker-compose.yml

@@ -1,7 +1,7 @@
 ---
 services:
   gitlab:
-    image: gitlab/gitlab-ce:18.4.1-ce.0
+    image: gitlab/gitlab-ce:18.4.1-ce.0@sha256:d24a77b3743174e055646c523b65862587e4fd44ed8aec8fa8a7dd2321299ebd
     container_name: gitlab
     hostname: 'gitlab'
     ports:
@@ -27,7 +27,7 @@ services:
   #     - DOCKER_HOST=unix:///var/run/docker.sock
 
   nginx:
-    image: nginx:stable
+    image: nginx:stable@sha256:3b4019335070fb6445987c8dd72cf18dec2cbc63b3575581eb66469c8173cd4f
     container_name: nginx
     depends_on:
       - gitlab
@@ -40,7 +40,7 @@ services:
     restart: always
 
   docker-cleanup:
-    image: docker:latest
+    image: docker:latest@sha256:24173119fa6d1b5b4a27ab164fa7863deb66574ee5b90fef3b85dc888ef1a7e6
     container_name: docker-cleanup
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock

ansible/roles/vault/files/docker-compose.yml

@@ -1,7 +1,7 @@
 ---
 services:
   vault:
-    image: hashicorp/vault:1.20.4
+    image: hashicorp/vault:1.20.4@sha256:268bb80aa9c6d13d65fcfa05c0c268caca068952240a8087291a6ce0b66e3a10
     container_name: vault
     ports:
       - "8200:8200"

docker-compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
   mkdocs:
-    image: squidfunk/mkdocs-material:latest
+    image: squidfunk/mkdocs-material:latest@sha256:00f9276315990b82f5af8c47bb2b71e2c69aef9f02a08f8dffd2515f42310753
     volumes:
       - .:/docs
     ports:

gl-sast-report.json

@@ -1,7 +1,7 @@
 n8n:
   image:
     repository: n8nio/n8n
-    tag: "1.114.4"
+    tag: "1.114.4@sha256:38e83833f4933c2e50a908b7accce76909e23878158762d6c21beb72cb4c657f"
     pullPolicy: IfNotPresent
 
   main:

kubernetes/charts/n8n/values.yaml

@@ -377,7 +377,7 @@ monitoring:
   # Proxmox VE Exporter (opzionale)
   pveExporter:
     enabled: true
-    image: "prompve/prometheus-pve-exporter:3.5.5"
+    image: "prompve/prometheus-pve-exporter:3.5.5@sha256:79a5598906697b1a5a006d09f0200528a77c6ff1568faf018539ac65824454df"
     replicas: 1
     verifySsl: false
     scrapeInterval: "30s"