Dependencies not pinned by hash

[osyniakov]

Dependencies not pinned by hash pose a supply chain security risk.

Pinning by hash ensures that the build will only accept the exact, verified files.

This typically involves reviewing and updating:

• GitHub Actions: Pinning all third-party GitHub Actions to a full commit SHA (e.g., actions/checkout@v4 becomes actions/checkout@<FULL_SHA_HASH>).

• Container Images: Pinning images in Dockerfiles/Compose files to their digest (e.g., image: latest or image: v1 becomes image@sha256:).

• Build/Runtime Dependencies: Ensuring all package manifest files (package.json, requirements.txt, go.mod, etc.) use a lockfile that includes dependency hashes, or updating the dependencies themselves to include a verifiable hash.