ci(tools): pin dependencies (#160)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/automerge.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Generate token
         id: token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
         with:
           app_id: ${{ secrets.TOKEN_EXCHANGE_APP }}
           installation_retrieval_mode: id
@@ -31,7 +31,7 @@ jobs:
 
       - name: Fetch metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/binaries.yml

@@ -16,19 +16,19 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Configure aws
         id: aws
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: eu-central-1
 
       - name: Setup golang
         id: golang
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:
           go-version-file: go.mod
 
@@ -42,7 +42,7 @@ jobs:
 
       - name: Sign release
         id: gpgsign
-        uses: actionhippie/gpgsign@v1
+        uses: actionhippie/gpgsign@2cb842660aa570b2229635c734846c209dd6d3a4 # v1
         with:
           private_key: ${{ secrets.GNUPG_KEY }}
           passphrase: ${{ secrets.GNUPG_PASSWORD }}
@@ -53,14 +53,14 @@ jobs:
       - name: Build changes
         id: changelog
         if: startsWith(github.ref, 'refs/tags/')
-        uses: actionhippie/calens@v1
+        uses: actionhippie/calens@b1c542833c54af20da5d839f86cf73ecd59360e2 # v1
         with:
           version: ${{ github.ref }}
 
       - name: Upload release
         id: upload
         if: startsWith(github.ref, 'refs/tags/')
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           body: ${{ steps.changelog.outputs.generated }}

.github/workflows/changes.yml

@@ -14,13 +14,13 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
 
       - name: Setup golang
         id: golang
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:
           go-version-file: go.mod
 
@@ -30,7 +30,7 @@ jobs:
 
       - name: Commit changes
         id: commit
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           author_name: GitHub Actions
           author_email: [email protected]

.github/workflows/docker.yml

@@ -33,11 +33,11 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Setup golang
         id: golang
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:
           go-version-file: go.mod
 
@@ -59,7 +59,7 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           images: |
@@ -80,23 +80,23 @@ jobs:
 
       - name: Setup qemu
         id: qemu
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
 
       - name: Setup buildx
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
 
       - name: Hub login
         id: login1
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         if: github.event_name != 'pull_request'
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Quay login
         id: login2
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         if: github.event_name != 'pull_request'
         with:
           registry: quay.io
@@ -105,7 +105,7 @@ jobs:
 
       - name: Ghcr login
         id: login3
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
@@ -114,7 +114,7 @@ jobs:
 
       - name: Build image
         id: publish
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
@@ -132,11 +132,11 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Hub tags
         id: hubTags
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           images: webhippie/mygithub
@@ -148,7 +148,7 @@ jobs:
 
       - name: Hub manifest
         id: hub
-        uses: actionhippie/manifest@v1
+        uses: actionhippie/manifest@6e645218a2939c5ec0f239ed80e5b7ff903b9cc2 # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -159,7 +159,7 @@ jobs:
 
       - name: Quay tags
         id: quayTags
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           images: quay.io/webhippie/mygithub
@@ -171,7 +171,7 @@ jobs:
 
       - name: Quay manifest
         id: quay
-        uses: actionhippie/manifest@v1
+        uses: actionhippie/manifest@6e645218a2939c5ec0f239ed80e5b7ff903b9cc2 # v1
         with:
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_PASSWORD }}
@@ -182,7 +182,7 @@ jobs:
 
       - name: Ghcr tags
         id: ghcrTags
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           images: ghcr.io/webhippie/mygithub
@@ -194,7 +194,7 @@ jobs:
 
       - name: Ghcr manifest
         id: ghcr
-        uses: actionhippie/manifest@v1
+        uses: actionhippie/manifest@6e645218a2939c5ec0f239ed80e5b7ff903b9cc2 # v1
         with:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
@@ -210,11 +210,11 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Hub readme
         id: hub
-        uses: actionhippie/pushrm@v1
+        uses: actionhippie/pushrm@d4137e5e7261e06ddc57e0efece0fb4f589abb0a # v1
         with:
           provider: dockerhub
           target: webhippie/mygithub
@@ -225,7 +225,7 @@ jobs:
 
       - name: Quay readme
         id: quay
-        uses: actionhippie/pushrm@v1
+        uses: actionhippie/pushrm@d4137e5e7261e06ddc57e0efece0fb4f589abb0a # v1
         with:
           provider: quay
           target: quay.io/webhippie/mygithub

.github/workflows/docs.yml

@@ -14,11 +14,11 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Setup hugo
         id: hugo
-        uses: peaceiris/actions-hugo@v3
+        uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3
         with:
           hugo-version: latest
           extended: true
@@ -29,7 +29,7 @@ jobs:
 
       - name: Deploy pages
         id: deploy
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: docs/public/

.github/workflows/flake.yml

@@ -17,13 +17,13 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
 
       - name: Install nix
         id: nix
-        uses: cachix/install-nix-action@v31
+        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - name: Update flake
         id: flake
@@ -34,7 +34,7 @@ jobs:
         run: git pull --autostash --rebase
 
       - name: Commit changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           author_name: GitHub Actions
           author_email: [email protected]

.github/workflows/general.yml

@@ -17,11 +17,11 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Setup golang
         id: golang
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:
           go-version-file: go.mod
 
@@ -52,7 +52,7 @@ jobs:
       - name: Coverage report
         id: codacy
         if: github.ref == 'refs/heads/master'
-        uses: codacy/codacy-coverage-reporter-action@v1
+        uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1
         with:
           project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
           coverage-reports: coverage.out