chore(deps): pin dependencies

.github/workflows/builder.yml

@@ -22,13 +22,13 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y qemu-user-static
       - name: Checkout repository
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Login to ghcr.io
         run: buildah login --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
       - name: Login to quay.io
         run: buildah login --username ${{ secrets.QUAY_USER }} --password ${{ secrets.QUAY_PASSWORD }} quay.io
       - name: Build
-        uses: redhat-actions/buildah-build@v2.12
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2.12
         with:
           image: ${{ env.IMAGE }}
           tags: latest

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      image: quay.io/centos-boot/builder:latest
+      image: quay.io/centos-boot/builder:latest@sha256:234e19e74e1eec123dfab1603d7e3b56f35080becfe635e9232750ca85a95841
       options: --privileged
 
     strategy:

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
+    rev: v4.5.0
     hooks:
       - id: end-of-file-fixer
       - id: trailing-whitespace
@@ -22,10 +22,10 @@ repos:
       - id: check-json
       - id: check-yaml
   - repo: https://github.com/markdownlint/markdownlint
-    rev: v0.12.0
+    rev: v0.13.0
     hooks:
       - id: markdownlint
   - repo: https://github.com/maxbrunet/pre-commit-renovate
-    rev: 35.82.0
+    rev: 37.46.0
     hooks:
       - id: renovate-config-validator

builder/Containerfile

@@ -1,5 +1,5 @@
 # This image contains the baseline tools to build bootable base images.
-FROM quay.io/centos/centos:stream9
+FROM quay.io/centos/centos:stream9@sha256:34f587a3228a2a924a114e5bd04450c119e9d803154f18e27eb97530c5ea13f5
 COPY coreos-continuous.repo /etc/yum.repos.d
 COPY . /src
 RUN /src/build.sh && cd / && rm /src -rf