chore(deps): pin dependencies (#1657)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/4v_deploy.yml

@@ -62,7 +62,7 @@ jobs:
       github.event.inputs.build_latest_as_test == 'false' ||
       github.event.inputs.build_latest_as_test == ''
     needs: get_build_number
-    uses: sdr-enthusiasts/common-github-workflows/.github/workflows/sdre.yml@main
+    uses: sdr-enthusiasts/common-github-workflows/.github/workflows/sdre.yml@226b2948a95ef5a19b6c1b2e1aaf12a645c5f382 # main
     with:
       push_enabled: true
       push_destinations: ghcr.io

.github/workflows/4v_deploy_bleeding_edge.yml

@@ -62,7 +62,7 @@ jobs:
       github.event.inputs.build_latest_as_test == 'false' ||
       github.event.inputs.build_latest_as_test == ''
     needs: get_build_number
-    uses: sdr-enthusiasts/common-github-workflows/.github/workflows/sdre.yml@main
+    uses: sdr-enthusiasts/common-github-workflows/.github/workflows/sdre.yml@226b2948a95ef5a19b6c1b2e1aaf12a645c5f382 # main
     with:
       push_enabled: true
       push_destinations: ghcr.io

.github/workflows/deploy.yml

@@ -69,7 +69,7 @@ jobs:
       github.event.inputs.build_latest_as_test == 'false' ||
       github.event.inputs.build_latest_as_test == ''
     needs: get_version
-    uses: sdr-enthusiasts/common-github-workflows/.github/workflows/sdre.yml@main
+    uses: sdr-enthusiasts/common-github-workflows/.github/workflows/sdre.yml@226b2948a95ef5a19b6c1b2e1aaf12a645c5f382 # main
     with:
       push_enabled: true
       push_destinations: ghcr.io
@@ -89,7 +89,7 @@ jobs:
     if: |
       github.event.inputs.build_latest_as_test == 'true' &&
       (github.event.inputs.use_test_image == 'false' || github.event.inputs.use_test_image == '')
-    uses: sdr-enthusiasts/common-github-workflows/.github/workflows/sdre.yml@main
+    uses: sdr-enthusiasts/common-github-workflows/.github/workflows/sdre.yml@226b2948a95ef5a19b6c1b2e1aaf12a645c5f382 # main
     needs: get_version
     with:
       push_enabled: true

.github/workflows/e2e.yml

@@ -17,13 +17,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2
 
       - name: Run E2E tests (Docker Playwright — Chromium, Firefox, WebKit, Mobile)
         run: just test-e2e-docker
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: failure()
         with:
           name: playwright-report

.github/workflows/fullstack-e2e.yml

@@ -46,10 +46,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
           cache: "npm"
@@ -100,7 +100,7 @@ jobs:
         run: docker compose -f docker-compose.test.yml down --volumes --timeout 5
 
       - name: Upload Playwright report on failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: failure()
         with:
           name: integration-playwright-report

.github/workflows/test-build.yml

@@ -21,15 +21,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Build Docker Image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           platforms: ${{ matrix.platform }}

Dockerfile.e2e

@@ -15,7 +15,7 @@
 # Or via justfile:
 #   just test-e2e-docker
 # ============================================================
-FROM mcr.microsoft.com/playwright:v1.58.2-noble
+FROM mcr.microsoft.com/playwright:v1.58.2-noble@sha256:6446946a1d9fd62d9ae501312a2d76a43ee688542b21622056a372959b65d63d
 
 WORKDIR /work
 

docker-compose-testing-example.yaml

@@ -1,7 +1,7 @@
 services:
   # Nginx reverse proxy for testing subpath deployment
   nginx:
-    image: nginx:alpine
+    image: nginx:alpine@sha256:e7257f1ef28ba17cf7c248cb8ccf6f0c6e0228ab9c315c152f9c203cd34cf6d1
     container_name: acarshub-nginx
     restart: always
     ports:

docker-compose.test.yml

@@ -28,7 +28,7 @@ services:
   # the RRD → SQLite migration has already been applied (the seed.db already
   # contains the pre-migrated timeseries_stats rows).
   db-init:
-    image: alpine:3
+    image: alpine:3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
     volumes:
       - ./test-fixtures:/src:ro
       - acarshub-test-db:/run/acars
@@ -103,7 +103,7 @@ services:
   # builds, identical to the `test-e2e-docker` justfile target.  Docker reuses
   # the volumes on subsequent runs so `npm ci` is fast after the first install.
   playwright:
-    image: mcr.microsoft.com/playwright:v1.58.2-noble
+    image: mcr.microsoft.com/playwright:v1.58.2-noble@sha256:6446946a1d9fd62d9ae501312a2d76a43ee688542b21622056a372959b65d63d
     depends_on:
       backend:
         condition: service_healthy