chore(deps): pin dependencies

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
     # Service containers to run
     services:
       postgres:
-        image: postgres
+        image: postgres@sha256:52e6ffd11fddd081ae63880b635b2a61c14008c17fc98cdc7ce5472265516dd0
         env:
           POSTGRES_PASSWORD: postgres
         # Set health checks to wait until postgres has started
@@ -100,7 +100,7 @@ jobs:
     - name: Build
       run: PYTHONPATH=build-support/bin uv build "src/${{steps.get-app-name.outputs.app-package}}"
 
-    - uses: pypa/gh-action-pypi-publish@release/v1
+    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
       with:
         user: __token__
         password: ${{ secrets.PYPI_TOKEN }}

Dockerfile

@@ -1,5 +1,5 @@
-# syntax=docker/dockerfile:1
-FROM ubuntu:latest as base
+# syntax=docker/dockerfile:1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
+FROM ubuntu:latest@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b as base
 
 SHELL ["bash", "-l", "-c"]
 ENV SHELL=/bin/bash
@@ -17,7 +17,7 @@ WORKDIR /tmp
 COPY apt.txt /tmp/apt.txt
 RUN xargs apt-get install -y <apt.txt
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.2 /uv /uvx /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.11.2@sha256:c4f5de312ee66d46810635ffc5df34a1973ba753e7241ce3a08ef979ddd7bea5 /uv /uvx /bin/
 
 RUN useradd -G ubuntu dev
 USER dev

docker-compose.yml

@@ -2,15 +2,15 @@
 services:
 
   db:
-    image: postgres
+    image: postgres@sha256:52e6ffd11fddd081ae63880b635b2a61c14008c17fc98cdc7ce5472265516dd0
     environment:
       POSTGRES_DB: ol_django
       POSTGRES_PASSWORD: postgres
     ports:
     - "${POSTGRES_PORT:-55432}:5432"
 
   redis:
-    image: redis
+    image: redis@sha256:1f073813b641755b70b0200da64131bbeeb4ec5b633ca67772229b49820caafa
     ports:
     - "${REDIS_PORT:-36379}:6379"