Harden Github actions - pinned-dependencies (part -1) (open-telemetry#3380)

Author: lalitb

.devcontainer/Dockerfile.conan

@@ -1,6 +1,6 @@
 # Copyright The OpenTelemetry Authors
 # SPDX-License-Identifier: Apache-2.0
-FROM ubuntu:24.04
+FROM ubuntu:24.04@sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02
 
 RUN apt update && apt install -y \
 	build-essential \
@@ -19,7 +19,7 @@ RUN apt update && apt install -y \
 	libtool \
 	python3-pip
 
-RUN pip install conan --break-system-packages
+RUN pip install "conan==2.15.1" --break-system-packages
 
 ARG USER_UID=1000
 ARG USER_GID=1000
@@ -52,4 +52,4 @@ WORKDIR  /workspaces/opentelemetry-cpp
 
 ENTRYPOINT []
 
-CMD ["/bin/bash"]
+CMD ["/bin/bash"]

.devcontainer/Dockerfile.dev

@@ -47,7 +47,7 @@ ENV IS_CONTAINER_BUILD=true
 
 COPY ./.devcontainer/customize_container.sh /tmp/opentelemetry_cpp/devcontainer/customize_container.sh
 RUN /tmp/opentelemetry_cpp/devcontainer/customize_container.sh
-RUN apt install -y npm && npm install -g markdownlint-cli
+RUN apt install -y npm && npm install -g markdownlint-cli@0.44.0
 
 USER devuser
 

.github/workflows/ci.yml

@@ -913,7 +913,7 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: install markdownlint-cli
-      run: sudo npm install -g markdownlint-cli
+      run: sudo npm install -g markdownlint-cli@0.44.0
 
     - name: run markdownlint
       run: markdownlint .
@@ -982,7 +982,7 @@ jobs:
       - name: install dependencies
         run: |
           sudo apt update && sudo apt install python3-pip
-          sudo pip3 install aiohttp
+          sudo pip3 install aiohttp==3.11.18
       - name: run w3c trace-context test suite
         env:
           SPEC_LEVEL: 1

.github/workflows/cmake_install.yml

@@ -209,8 +209,8 @@ jobs:
           submodules: 'recursive'
       - name: Install Conan
         run: |
-          python3 -m pip install --upgrade pip
-          pip install "conan>=2.0,<3"
+          python3 -m pip install pip==25.0.1
+          pip install "conan==2.15.1"
           conan profile detect --force
       - name: Install or build all dependencies with Conan
         run: |
@@ -247,8 +247,8 @@ jobs:
           submodules: 'recursive'
       - name: Install Conan
         run: |
-          python3 -m pip install --upgrade pip
-          pip install "conan>=2.0,<3"
+          python3 -m pip install pip==25.0.1
+          pip install "conan==2.15.1"
           conan profile detect --force
       - name: Install or build all dependencies with Conan
         run: |

docker/ubuntuLatest/Dockerfile

@@ -1,8 +1,9 @@
 # Copyright The OpenTelemetry Authors
 # SPDX-License-Identifier: Apache-2.0
 
-FROM ubuntu:latest
+FROM ubuntu:latest@sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02
 ENV DEBIAN_FRONTEND=noninteractive
+
 WORKDIR /work
 
 #install grpc and abseil

functional/otlp/Dockerfile

@@ -1,7 +1,7 @@
 # Copyright The OpenTelemetry Authors
 # SPDX-License-Identifier: Apache-2.0
 
-FROM otel/opentelemetry-collector
+FROM otel/opentelemetry-collector:0.123.0@sha256:c8e36258c1b26927fb7b05c5186b90e9c3d77315efc24f65d6fddec1c14b60b3
 COPY . .
 CMD ["--config", "/otel-cpp/otel-config.yaml"]
 EXPOSE 4317