Pin dependencies

.github/workflows/ci.yml

@@ -12,10 +12,10 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: Setup .NET Core SDK
-      uses: actions/setup-dotnet@v3
+      uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3
       with:
         dotnet-version: '8.0.x'
 
@@ -49,25 +49,25 @@ jobs:
         done
 
     - name: Upload a Build Artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
       with:
         name: TeslaMateAgile-linux-x64
         path: ./output/TeslaMateAgile-linux-x64
 
     - name: Upload a Build Artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
       with:
         name: TeslaMateAgile-linux-arm64
         path: ./output/TeslaMateAgile-linux-arm64
 
     - name: Upload a Build Artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
       with:
         name: TeslaMateAgile-linux-arm
         path: ./output/TeslaMateAgile-linux-arm
 
     - name: Upload a Build Artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
       with:
         name: TeslaMateAgile-win-x64
         path: ./output/TeslaMateAgile-win-x64
@@ -123,7 +123,7 @@ jobs:
       if: startsWith(github.ref, 'refs/tags/')
 
     - name: Create Release
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
       with:
         name: Release ${{ github.ref_name }}
         draft: true
@@ -137,15 +137,15 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: Azure Login
-      uses: Azure/login@v1
+      uses: Azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1
       with:
         creds: ${{ secrets.AZURE_CREDENTIALS }}
 
     - name: Login to Kubernetes
-      uses: Azure/aks-set-context@v3
+      uses: Azure/aks-set-context@4edaee69f820359371ee8bc85189ac03a21d3a58 # v3
       with:
         resource-group: abyss
         cluster-name: abyss

.github/workflows/codeql-analysis.yml

@@ -20,20 +20,20 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: Setup .NET Core SDK
-      uses: actions/setup-dotnet@v3
+      uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3
       with:
         dotnet-version: '8.0.x'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@e2b57b01d64b69ac273abfbea5d3ed15231e1706 # v2
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@e2b57b01d64b69ac273abfbea5d3ed15231e1706 # v2
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@e2b57b01d64b69ac273abfbea5d3ed15231e1706 # v2

.github/workflows/deploy.yml

@@ -6,15 +6,15 @@ jobs:
     name: Deploy
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     - name: Azure Login
-      uses: Azure/login@v1
+      uses: Azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1
       with:
         creds: ${{ secrets.AZURE_CREDENTIALS }}
 
     - name: Login to Kubernetes
-      uses: Azure/aks-set-context@v3
+      uses: Azure/aks-set-context@4edaee69f820359371ee8bc85189ac03a21d3a58 # v3
       with:
         resource-group: abyss
         cluster-name: abyss

TeslaMateAgile/Dockerfile

@@ -4,7 +4,7 @@ FROM mcr.microsoft.com/dotnet/runtime:8.0-${arch} AS base
 USER app
 WORKDIR /app
 
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+FROM mcr.microsoft.com/dotnet/sdk:8.0@sha256:f91f9181d68b5ed2c8dea199dbbd2f6d172e60bdc43f8a67878b1ad140cf8d6b AS build
 ARG BUILD_CONFIGURATION=Release
 WORKDIR /src
 COPY ["TeslaMateAgile/TeslaMateAgile.csproj", "TeslaMateAgile/"]

charts/teslamateagile/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: mattjeanes/teslamateagile
-  tag: v1.16.0
+  tag: v1.16.0@sha256:68e016a899488c12421b5e47a45460125da1c7a2090a69771ef36a0456ed5a13
   pullPolicy: IfNotPresent
 resources:
   requests: