chore(deps): pin dependencies

.github/workflows/semgrep.yml

@@ -18,7 +18,7 @@ jobs:
     env:
       SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
     container:
-      image: returntocorp/semgrep
+      image: returntocorp/semgrep@sha256:bacb1190716dab2b1708dc63c5bf11f6014c16511e5117f83592acbc5530087a
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - run: semgrep ci

.github/workflows/sonarcloud.yaml

@@ -11,7 +11,7 @@ jobs:
   sonarcloud:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       with:
         # Disabling shallow clone is recommended for improving relevancy of reporting
         fetch-depth: 0

Dockerfile

@@ -1,4 +1,4 @@
-FROM cgr.dev/chainguard/python:latest-dev AS builder
+FROM cgr.dev/chainguard/python:latest-dev@sha256:40b3a19b7e2a50824b1ff32d61ae5f59af1b0de67f7bb8e56f5804bace0d94b7 AS builder
 
 ARG dist_file
 
@@ -10,7 +10,7 @@ RUN --mount=type=secret,id=requirements,dst=/home/nonroot/requirements.txt,uid=6
     pip install --no-cache-dir -r "/home/nonroot/requirements.txt"
 RUN pip install --no-cache-dir "/home/nonroot/${dist_file}"
 
-FROM cgr.dev/chainguard/python:latest
+FROM cgr.dev/chainguard/python:latest@sha256:5f16431f56f330925a9c8f5168b31ca65f603de15b127b376f8532bab11583c0
 
 WORKDIR /app
 

docker-compose.development.yml

@@ -1,6 +1,6 @@
 services:
   db:
-    image: postgres
+    image: postgres@sha256:5c587078ef86f4b5fd24c9ed4394429e59035ead421873c14135d5b57c117908
     restart: always
     # set shared memory limit when using docker-compose
     shm_size: 128mb