chore: #127 Pin dependencies in pipeline and setup 'next' image tag

Signed-off-by: Laurent Broudoux <[email protected]>

Author: lbroudoux

.github/workflows/build-verify.yml

@@ -27,12 +27,13 @@ jobs:
         run: echo "date=$(date +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
 
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b #v5.4.0
         with:
-          go-version: '1.23.x'
+          go-version-file: ./go.mod
+          cache-dependency-path: ./go.sum
 
       - name: Build Go packages
         run: |
@@ -44,24 +45,35 @@ jobs:
           set -x
           if [[ $GITHUB_REF == 'refs/heads/master' ]]; then
             echo "IMAGE_TAG=nightly" >> "$GITHUB_ENV"
+            echo "IMAGE_TAG=nightly" >> "$GITHUB_OUTPUT"
             echo "PACKAGE_IMAGE=true" >> "$GITHUB_ENV"
+            echo "PACKAGE_IMAGE=true" >> "$GITHUB_OUTPUT"
+          elif [[ $GITHUB_REF == 'refs/heads/1.x' ]]; then
+            echo "IMAGE_TAG=next" >> "$GITHUB_ENV"
+            echo "IMAGE_TAG=next" >> "$GITHUB_OUTPUT"
+            echo "PACKAGE_IMAGE=true" >> "$GITHUB_ENV"
+            echo "PACKAGE_IMAGE=true" >> "$GITHUB_OUTPUT"
           elif [[ $GITHUB_REF == "refs/tags/$GITHUB_REF_NAME" ]]; then
             echo "IMAGE_TAG=$GITHUB_REF_NAME" >> "$GITHUB_ENV"
+            echo "IMAGE_TAG=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
             echo "PACKAGE_IMAGE=true" >> "$GITHUB_ENV"
+            echo "PACKAGE_IMAGE=true" >> "$GITHUB_OUTPUT"
           else
             echo "PACKAGE_IMAGE=false" >> "$GITHUB_ENV"
+            echo "PACKAGE_IMAGE=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Install Cosign
-        uses: sigstore/[email protected]
+        if: github.repository_owner == 'microcks' && env.PACKAGE_IMAGE == 'true'
+        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
 
       - name: Set up QEMU
         if: github.repository_owner == 'microcks' && env.PACKAGE_IMAGE == 'true'
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Set up Docker Buildx
         if: github.repository_owner == 'microcks' && env.PACKAGE_IMAGE == 'true'
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to Quay.io and Docker Hub registries and setup multi-arch builder
         if: github.repository_owner == 'microcks' && env.PACKAGE_IMAGE == 'true'
@@ -73,7 +85,7 @@ jobs:
 
       - name: Build and push container image for cli
         id: build-and-push
-        uses: docker/[email protected]
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         if: github.repository_owner == 'microcks' && env.PACKAGE_IMAGE == 'true'
         with:
           context: .
@@ -89,6 +101,7 @@ jobs:
           tags: quay.io/microcks/microcks-cli:${{env.IMAGE_TAG}},docker.io/microcks/microcks-cli:${{env.IMAGE_TAG}}
 
       - name: Sign the image with GitHub OIDC Token
+        if: github.repository_owner == 'microcks' && env.PACKAGE_IMAGE == 'true'
         env:
           DIGEST: ${{ steps.build-and-push.outputs.digest }}
           TAGS: quay.io/microcks/microcks-cli:${{env.IMAGE_TAG}} docker.io/microcks/microcks-cli:${{env.IMAGE_TAG}}

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }}
           fetch-depth: 0