chore(deps): pin dependencies

.github/workflows/ruby.yml

@@ -65,7 +65,7 @@ jobs:
     # Make redis available for running the tryouts
     services:
       redis:
-        image: redis:bookworm
+        image: redis:bookworm@sha256:7698c87214812f17054ca55cfc66d4c59fa762c801ba6193d87c4da73214b3c3
         # Set health checks to wait until redis has started
         options: >-
           --health-cmd "redis-cli ping"
@@ -75,13 +75,13 @@ jobs:
 
     steps:
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
+        uses: mxschmitt/action-tmate@a283f9441d2d96eb62436dc46d7014f5d357ac22 # v3
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
         with:
           detached: true
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
 
       - name: Set up Ruby ${{ matrix.ruby }}
         uses: ruby/setup-ruby@v1

Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:experimental
+# syntax=docker/dockerfile:experimental@sha256:600e5c62eedff338b3f7a0850beb7c05866e0ef27b2d2e8c02aa468e78496ff5
 
 ##
 # ONETIME - DOCKER IMAGE - 2024-04-10
@@ -69,7 +69,7 @@
 ARG CODE_ROOT=/app
 ARG ONETIME_HOME=/opt/onetime
 
-FROM ruby:3.2-slim-bookworm AS builder
+FROM ruby:3.2-slim-bookworm@sha256:46af94ae9b84869d23510765fceb8176183c3118db82d73d54739e6b019b72df AS builder
 
 # Limit to packages needed for the system itself
 # NOTE: We only need the build tools installed if we need

docker-compose.yml

@@ -62,7 +62,7 @@ services:
       - ./etc/config:/etc/config
 
   redis:
-    image: redis:bookworm
+    image: redis:bookworm@sha256:7698c87214812f17054ca55cfc66d4c59fa762c801ba6193d87c4da73214b3c3
     container_name: onetime-redis
     ports:
       - 6379:6379