chore(deps): pin dependencies

.github/actions/build-sign-and-package-plugin/action.yml

@@ -31,7 +31,7 @@ runs:
       run: |
         echo filename="grafana-oncall-app-${{ steps.plugin-version.outputs.version }}.zip" >> $GITHUB_OUTPUT
     - name: Install Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@19bb51245e9c80abacb2e91cc42b33fa478b8639 # v4
       with:
         go-version: "1.21.5"
     - name: Install Mage

.github/actions/install-frontend-dependencies/action.yml

@@ -24,7 +24,7 @@ runs:
       # yamllint disable rule:line-length
       run: echo "pnpm-lock-location=${{ steps.grafana-plugin-directory.outputs.grafana-plugin-directory }}/pnpm-lock.yaml" >> $GITHUB_OUTPUT
       # yamllint enable rule:line-length
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: 20.15.1
         cache: pnpm

.github/actions/setup-python/action.yml

@@ -14,7 +14,7 @@ runs:
   steps:
     - name: Setup Python
       id: setup-python
-      uses: actions/setup-python@v5.1.0
+      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
       env:
         PYTHON_REQUIREMENTS_PATHS: ${{ inputs.python-requirements-paths }}
       with:

.github/workflows/build-engine-docker-image-and-publish-to-dockerhub.yml

@@ -21,7 +21,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           # we have one large .whl file which is referenced in the engine Dockerfile.. we need to
           # fetch that file to be able to properly build the image

.github/workflows/e2e-tests.yml

@@ -25,7 +25,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           persist-credentials: false
 
@@ -58,7 +58,7 @@ jobs:
 
       - name: Use cached plugin frontend build
         id: cache-plugin-frontend
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: grafana-plugin/dist
           key: ${{ runner.os }}-plugin-frontend-${{ hashFiles('grafana-plugin/src/**/*', 'grafana-plugin/pnpm.lock') }}
@@ -79,7 +79,7 @@ jobs:
 
       - name: Cache Playwright binaries/dependencies
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: "~/.cache/ms-playwright"
           key: ${{ runner.os }}-playwright-${{ env.PLAYWRIGHT_VERSION }}-${{ inputs.browsers }}
@@ -93,7 +93,7 @@ jobs:
         run: pnpm playwright install
 
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@19bb51245e9c80abacb2e91cc42b33fa478b8639 # v4
         with:
           go-version: "1.21.5"
 
@@ -109,18 +109,18 @@ jobs:
 
       - name: Setup Pages
         if: failure()
-        uses: actions/configure-pages@v2
+        uses: actions/configure-pages@c5a3e1159e0cbdf0845eb8811bd39e39fc3099c2 # v2
 
       - name: Upload artifact
         if: failure()
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: ./grafana-plugin/playwright-report/
 
       - name: Deploy to GitHub Pages
         if: failure()
         id: deployment
-        uses: actions/deploy-pages@v3
+        uses: actions/deploy-pages@13b55b33dd8996121833dbc1db458c793a334630 # v3
         with:
           preview: true
 

.github/workflows/linting-and-tests.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Python
         uses: ./.github/actions/setup-python
         with:
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Install frontend dependencies
         uses: ./.github/actions/install-frontend-dependencies
       - name: Build, lint and test frontend
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     steps:
       - name: "Check out code"
-        uses: "actions/checkout@v4"
+        uses: "actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955" # v4
       - name: "Build website"
         # -e HUGO_REFLINKSERRORLEVEL=ERROR prevents merging broken refs with the downside
         # that no refs to external content can be used as these refs will not resolve in the
@@ -59,22 +59,22 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     services:
       rabbit_test:
-        image: rabbitmq:3.12.0
+        image: rabbitmq:3.12.0@sha256:f895715b160004e9c305b5809c20c8b1b3aef07bbe2c8127a2df6f70134301e3
         env:
           RABBITMQ_DEFAULT_USER: rabbitmq
           RABBITMQ_DEFAULT_PASS: rabbitmq
         ports:
           - 5672:5672
       mysql_test:
-        image: mysql:8.0.32
+        image: mysql:8.0.32@sha256:f496c25da703053a6e0717f1d52092205775304ea57535cc9fcaa6f35867800b
         env:
           MYSQL_DATABASE: oncall_local_dev
           MYSQL_ROOT_PASSWORD: local_dev_pwd
         ports:
           - 3306:3306
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Python
         uses: ./.github/actions/setup-python
       - name: Lint migrations
@@ -94,7 +94,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout PR code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           # Fetch all history so we can compare with the base branch
           fetch-depth: 0
@@ -182,7 +182,7 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 #v4.2.0
         with:
           version: v3.8.0
@@ -195,8 +195,8 @@ jobs:
     name: "Backend Tests: Plugin"
     runs-on: ubuntu-latest-16-cores
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - uses: actions/setup-go@19bb51245e9c80abacb2e91cc42b33fa478b8639 # v4
         with:
           go-version: "1.21.5"
       - run: cd grafana-plugin && go test ./pkg/...
@@ -211,22 +211,22 @@ jobs:
       ONCALL_TESTING_RBAC_ENABLED: ${{ matrix.rbac_enabled }}
     services:
       rabbit_test:
-        image: rabbitmq:3.12.0
+        image: rabbitmq:3.12.0@sha256:f895715b160004e9c305b5809c20c8b1b3aef07bbe2c8127a2df6f70134301e3
         env:
           RABBITMQ_DEFAULT_USER: rabbitmq
           RABBITMQ_DEFAULT_PASS: rabbitmq
         ports:
           - 5672:5672
       mysql_test:
-        image: mysql:8.0.32
+        image: mysql:8.0.32@sha256:f496c25da703053a6e0717f1d52092205775304ea57535cc9fcaa6f35867800b
         env:
           MYSQL_DATABASE: oncall_local_dev
           MYSQL_ROOT_PASSWORD: local_dev_pwd
         ports:
           - 3306:3306
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Python
         uses: ./.github/actions/setup-python
       - name: Wait for MySQL to be ready
@@ -250,14 +250,14 @@ jobs:
       ONCALL_TESTING_RBAC_ENABLED: ${{ matrix.rbac_enabled }}
     services:
       rabbit_test:
-        image: rabbitmq:3.12.0
+        image: rabbitmq:3.12.0@sha256:f895715b160004e9c305b5809c20c8b1b3aef07bbe2c8127a2df6f70134301e3
         env:
           RABBITMQ_DEFAULT_USER: rabbitmq
           RABBITMQ_DEFAULT_PASS: rabbitmq
         ports:
           - 5672:5672
       postgresql_test:
-        image: postgres:14.4
+        image: postgres:14.4@sha256:9ceb24f8c5f15c053d973a3610866f473690875dc13eb3282b45302189321040
         env:
           POSTGRES_DB: oncall_local_dev
           POSTGRES_PASSWORD: local_dev_pwd
@@ -271,7 +271,7 @@ jobs:
           --health-retries 5
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Python
         uses: ./.github/actions/setup-python
       - name: Test Django migrations work from blank slate
@@ -294,7 +294,7 @@ jobs:
       ONCALL_TESTING_RBAC_ENABLED: ${{ matrix.rbac_enabled }}
     services:
       redis_test:
-        image: redis:7.0.15
+        image: redis:7.0.15@sha256:352c1fdadc91926edda08f45aeb3f27f37194c2f14101229c0523a11195c96e3
         ports:
           - 6379:6379
         options: >-
@@ -304,7 +304,7 @@ jobs:
           --health-retries 5
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Python
         uses: ./.github/actions/setup-python
       - name: Test Django migrations work from blank slate
@@ -319,7 +319,7 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Python
         uses: ./.github/actions/setup-python
         with:
@@ -333,7 +333,7 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Python
         uses: ./.github/actions/setup-python
       - name: mypy Static Type Checking

.github/workflows/on-issue-closed.yml

@@ -10,7 +10,7 @@ jobs:
     name: Remove "needs triage" label
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Remove "needs triage" label
         uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 #v1.3.0
         with:

.github/workflows/on-issue-creation.yml

@@ -13,7 +13,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Get latest version tag
         id: get-latest-tag
         uses: actions-ecosystem/action-get-latest-tag@b7c32daec3395a9616f88548363a42652b22d435 #v1.6.0
@@ -35,7 +35,7 @@ jobs:
     name: Add "needs triage" label
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Add "needs triage" label
         uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf #v1.1.3
         with:
@@ -52,7 +52,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - id: issue-form-values
         uses: stefanbuck/github-issue-parser@2ea9b35a8c584529ed00891a8f7e41dc46d0441e #v3.2.1
 

.github/workflows/on-release-published.yml

@@ -22,7 +22,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Install frontend dependencies
         uses: ./.github/actions/install-frontend-dependencies
       # This will fetch the secret keys from vault and set them as environment variables for subsequent steps
@@ -80,7 +80,7 @@ jobs:
       helm_release_pr_number: ${{ fromJSON(steps.update-helm-chart-pr.outputs.pull_request).number }}
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Prepare version tags
         id: prepare-version-tags
         run: |

.github/workflows/publish-technical-documentation-next.yml

@@ -15,7 +15,7 @@ jobs:
       id-token: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       # publish-technical-documentation/v1.2.0
       - uses: grafana/writers-toolkit/publish-technical-documentation@39cdc38767184996e25d611923f8ce697e33bc70
         with:

.github/workflows/publish-technical-documentation-release.yml

@@ -17,13 +17,13 @@ jobs:
       id-token: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           fetch-depth: 0
       # yamllint disable rule:line-length
       # publish-technical-documentation-release/v2.2.4
       # yamllint disable rule:line-length
-      - uses: grafana/writers-toolkit/publish-technical-documentation-release@publish-technical-documentation-release/v2 # zizmor: ignore[unpinned-uses]
+      - uses: grafana/writers-toolkit/publish-technical-documentation-release@8cc658b604c6e05c275af30163a1c7728dfe19b2 # publish-technical-documentation-release/v2 # zizmor: ignore[unpinned-uses]
         # yamllint enable rule:line-length
         with:
           release_tag_regexp: "^v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"

.github/workflows/triage-stale-pull-requests.yml

@@ -9,7 +9,7 @@ jobs:
     name: Triage stale pull requests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8
         with:
           # docs - https://github.com/actions/stale
           # only triage pull requests
@@ -32,7 +32,7 @@ jobs:
     name: Triage stale issues
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8
         with:
           # docs - https://github.com/actions/stale
           # only triage issues

.github/workflows/update-make-docs.yml

@@ -9,7 +9,7 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - uses: grafana/writers-toolkit/update-make-docs@f65819d6a412b752c0e0263375215f049507b0e6 #update-make-docs/v1.3.0
         with:
           pr_options: --label "release:ignore"

.github/workflows/verify-public-docs-updated.yml

@@ -15,6 +15,6 @@ jobs:
     if: "!contains(github.event.pull_request.labels.*.name, 'pr:no public docs')"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1
       - name: Public documentation checker
         run: ./.github/verify-public-docs-updated.sh